Use-after-free in Binutils - CVE-2020-16592

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU79345

Use-after-free in Binutils - CVE-2020-16592

Published: August 10, 2023


Vulnerability identifier: #VU79345
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-16592
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to perform a denial of service attack.

The vulnerability exists in bfd_hash_lookup. A local attacker can trick the victim into opening a specially crafted data, trigger use-after-free and perform a denial of service attack.


Affected software

Binutils
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
Fedora
SUSE Linux Enterprise Module for Packagehub Subpackages
bpftrace-tools
bpftrace
binutils-multiarch (Ubuntu package)
binutils (Ubuntu package)
mingw-binutils
binutils-help
binutils-devel
binutils-debugsource
binutils-debuginfo
binutils
libctf0
libctf-nobfd0
libctf-nobfd0-debuginfo
libctf0-debuginfo
binutils-devel-32bit
binutils-gold-debuginfo
binutils-gold
cross-ppc-binutils
cross-ppc-binutils-debuginfo
cross-ppc-binutils-debugsource
cross-spu-binutils
cross-spu-binutils-debuginfo
cross-spu-binutils-debugsource
PowerStore X
PowerStore T

How to mitigate CVE-2020-16592

Install updates from vendor's website.

Binutils - update to 2.35
bpftrace-tools - update to 0.11.4-3.2.1
bpftrace - update to 0.11.4-3.2.1
binutils-multiarch (Ubuntu package) - addressed in versions 2.30-21ubuntu1~18.04.7, 2.34-6ubuntu1.3
binutils (Ubuntu package) - addressed in versions 2.30-21ubuntu1~18.04.7, 2.34-6ubuntu1.3
mingw-binutils - addressed in versions 2.32-8.fc32, 2.34-4.fc33
binutils-help - update to 2.34-9
binutils-devel - update to 2.34-9
binutils-debugsource - update to 2.34-9
binutils-debuginfo - update to 2.34-9
binutils - update to 2.34-9
libctf0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-debugsource - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-devel - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf-nobfd0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf-nobfd0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-devel-32bit - addressed in versions 2.37-6.23.1, 2.37-7.21.2
binutils-gold-debuginfo - addressed in versions 2.37-7.21.2, 2.37-9.39.1
binutils-gold - addressed in versions 2.37-7.21.2, 2.37-9.39.1
cross-ppc-binutils - update to 2.37-9.39.1
cross-ppc-binutils-debuginfo - update to 2.37-9.39.1
cross-ppc-binutils-debugsource - update to 2.37-9.39.1
cross-spu-binutils - update to 2.37-9.39.1
cross-spu-binutils-debuginfo - update to 2.37-9.39.1
cross-spu-binutils-debugsource - update to 2.37-9.39.1
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710

External References

Related Security Bulletins