Input validation error in Binutils - CVE-2017-8421

Vulnerability identifier: #VU39082

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-8421

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.

Binutils
Gentoo Linux
Ubuntu
binutils (Ubuntu package)
binutils-multiarch (Ubuntu package)
VMware Tanzu Operations Manager
Isolation Segment
VMware Tanzu Application Service for VMs
Platform Automation Toolkit

Install update from vendor's website.

binutils (Ubuntu package) - update to Ubuntu Pro (Infra-only)
binutils-multiarch (Ubuntu package) - update to Ubuntu Pro (Infra-only)
VMware Tanzu Operations Manager - update to 2.10.65
Isolation Segment - addressed in versions 3.0.19, 4.0.11
VMware Tanzu Application Service for VMs - addressed in versions 3.0.19, 4.0.11
Platform Automation Toolkit - addressed in versions 4.0.13, 4.1.13, 4.2.8, 4.3.5

• https://security.gentoo.org/glsa/201709-02
• https://sourceware.org/bugzilla/show_bug.cgi?id=21440

• Multiple vulnerabilities in GNU Binutils
• Gentoo update for Binutils
• VMware Tanzu products update for GNU binutils
• Ubuntu update for binutils