Input validation error in Binutils - CVE-2020-35493

Vulnerability identifier: #VU79353

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-35493

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service attack.

The vulnerability exists in bfd/pef.c. A local attacker can send a specially crafted PEF file and perform a denial of service attack.

Binutils
Gentoo Linux
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
Fedora
SUSE Linux Enterprise Module for Packagehub Subpackages
bpftrace
bpftrace-tools
mingw-binutils
sys-devel/binutils
binutils-debuginfo
binutils
binutils-debugsource
binutils-devel
libctf-nobfd0
libctf-nobfd0-debuginfo
libctf0
libctf0-debuginfo
binutils-devel-32bit
binutils-gold-debuginfo
binutils-gold
cross-ppc-binutils
cross-ppc-binutils-debuginfo
cross-ppc-binutils-debugsource
cross-spu-binutils
cross-spu-binutils-debuginfo
cross-spu-binutils-debugsource
IBM Cloud Pak for Security
PowerStore X
PowerStore T

Install updates from vendor's website.

Binutils - update to 2.34
bpftrace - update to 0.11.4-3.2.1
bpftrace-tools - update to 0.11.4-3.2.1
IBM Cloud Pak for Security - update to 1.11.2.0
mingw-binutils - update to 2.32-9.fc32
sys-devel/binutils - update to 2.35.2
binutils-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-debugsource - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-devel - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf-nobfd0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf-nobfd0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-devel-32bit - addressed in versions 2.37-6.23.1, 2.37-7.21.2
binutils-gold-debuginfo - addressed in versions 2.37-7.21.2, 2.37-9.39.1
binutils-gold - addressed in versions 2.37-7.21.2, 2.37-9.39.1
cross-ppc-binutils - update to 2.37-9.39.1
cross-ppc-binutils-debuginfo - update to 2.37-9.39.1
cross-ppc-binutils-debugsource - update to 2.37-9.39.1
cross-spu-binutils - update to 2.37-9.39.1
cross-spu-binutils-debuginfo - update to 2.37-9.39.1
cross-spu-binutils-debugsource - update to 2.37-9.39.1
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710

• https://bugzilla.redhat.com/show_bug.cgi?id=1911437
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KOK3QWSVOUJWJ54HVGIFWNLWQ5ZY4S6/
• https://security.netapp.com/advisory/ntap-20210212-0007/
• https://security.gentoo.org/glsa/202107-24

• Multiple vulnerabilities in Dell PowerStore Family
• SUSE update for binutils
• SUSE update for binutils
• SUSE update for binutils
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Gentoo update for Binutils
• Fedora 32 update for mingw-binutils