NULL pointer dereference in Binutils - CVE-2020-16593

Vulnerability identifier: #VU79346

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-16593

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in scan_unit_for_symbols. A local attacker can trick the victim into opening a specially crafted data and perform a denial of service (DoS) attack.

Binutils
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Packagehub Subpackages
bpftrace
bpftrace-tools
binutils-devel-32bit
binutils
binutils-debuginfo
binutils-debugsource
binutils-devel
libctf-nobfd0
libctf-nobfd0-debuginfo
libctf0
libctf0-debuginfo
binutils-gold-debuginfo
binutils-gold
cross-ppc-binutils
cross-ppc-binutils-debuginfo
cross-ppc-binutils-debugsource
cross-spu-binutils
cross-spu-binutils-debuginfo
cross-spu-binutils-debugsource
PowerStore X
PowerStore T

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

Binutils - update to 2.35.1
bpftrace - update to 0.11.4-3.2.1
bpftrace-tools - update to 0.11.4-3.2.1
binutils-devel-32bit - addressed in versions 2.37-6.23.1, 2.37-7.21.2
binutils - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-debugsource - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-devel - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf-nobfd0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf-nobfd0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-gold-debuginfo - addressed in versions 2.37-7.21.2, 2.37-9.39.1
binutils-gold - addressed in versions 2.37-7.21.2, 2.37-9.39.1
cross-ppc-binutils - update to 2.37-9.39.1
cross-ppc-binutils-debuginfo - update to 2.37-9.39.1
cross-ppc-binutils-debugsource - update to 2.37-9.39.1
cross-spu-binutils - update to 2.37-9.39.1
cross-spu-binutils-debuginfo - update to 2.37-9.39.1
cross-spu-binutils-debugsource - update to 2.37-9.39.1
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710

• https://sourceware.org/bugzilla/show_bug.cgi?id=25827
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aec72fda3b320c36eb99fc1c4cf95b10fc026729
• https://security.netapp.com/advisory/ntap-20210122-0003/

• Multiple vulnerabilities in Dell PowerStore Family
• SUSE update for binutils
• SUSE update for binutils
• SUSE update for binutils