NULL pointer dereference in Binutils - CVE-2020-16599

Vulnerability identifier: #VU79354

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-16599

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in _bfd_elf_get_symbol_version_string. A local attacker can trick the victim into opening a specially crafted file and perform a denial of service (DoS) attack.

Binutils
SUSE CaaS Platform
SUSE Enterprise Storage
HPE Helion Openstack
Anolis OS
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
SUSE Linux Enterprise Module for Packagehub Subpackages
gdbserver (Ubuntu package)
gdb (Ubuntu package)
Ubuntu security updates mailing list (Ubuntu package)
bpftrace
bpftrace-tools
binutils-devel
binutils
libctf-nobfd0-debuginfo
libctf-nobfd0
binutils-debugsource
binutils-debuginfo
libctf0
libctf0-debuginfo
binutils-devel-32bit
binutils-gold
binutils-gold-debuginfo
cross-spu-binutils-debugsource
cross-spu-binutils-debuginfo
cross-spu-binutils
cross-ppc-binutils-debugsource
cross-ppc-binutils-debuginfo
cross-ppc-binutils
binutils-help
gcc-toolset-12-binutils
gcc-toolset-12-binutils-devel
gcc-toolset-12-binutils-gold
PowerStore X
PowerStore T

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

Binutils - update to 2.35.1
gdbserver (Ubuntu package) - addressed in versions Ubuntu Pro, 9.2-0ubuntu1~20.04.2, 12.1-0ubuntu1~22.04.2
gdb (Ubuntu package) - addressed in versions Ubuntu Pro, 9.2-0ubuntu1~20.04.2, 12.1-0ubuntu1~22.04.2
Ubuntu security updates mailing list (Ubuntu package) - update to Security announcements mailing list
bpftrace - update to 0.11.4-3.2.1
bpftrace-tools - update to 0.11.4-3.2.1
binutils-devel - update to 2.30-119.0.2
binutils - update to 2.30-119.0.2
libctf-nobfd0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf-nobfd0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-devel - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-debugsource - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf0 - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
libctf0-debuginfo - addressed in versions 2.37-6.23.1, 2.37-7.21.2, 2.37-9.39.1
binutils-devel-32bit - addressed in versions 2.37-6.23.1, 2.37-7.21.2
binutils-gold - addressed in versions 2.37-7.21.2, 2.37-9.39.1
binutils-gold-debuginfo - addressed in versions 2.37-7.21.2, 2.37-9.39.1
cross-spu-binutils-debugsource - update to 2.37-9.39.1
cross-spu-binutils-debuginfo - update to 2.37-9.39.1
cross-spu-binutils - update to 2.37-9.39.1
cross-ppc-binutils-debugsource - update to 2.37-9.39.1
cross-ppc-binutils-debuginfo - update to 2.37-9.39.1
cross-ppc-binutils - update to 2.37-9.39.1
binutils-devel - addressed in versions 2.37-23, 2.37-25
binutils - addressed in versions 2.37-23, 2.37-25
binutils-debuginfo - addressed in versions 2.37-23, 2.37-25
binutils-help - addressed in versions 2.37-23, 2.37-25
binutils-debugsource - addressed in versions 2.37-23, 2.37-25
gcc-toolset-12-binutils - update to 2.38-17
gcc-toolset-12-binutils-devel - update to 2.38-17
gcc-toolset-12-binutils-gold - update to 2.38-17
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710

• https://sourceware.org/bugzilla/show_bug.cgi?id=25842
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d55d10ac0d112c586eaceb92e75bd9b80aadcc4
• https://security.netapp.com/advisory/ntap-20210122-0003/

• Multiple vulnerabilities in Dell PowerStore Family
• openEuler 22.03 LTS update for binutils
• openEuler 22.03 LTS SP1 update for binutils
• openEuler 22.03 LTS SP2 update for binutils
• Ubuntu update for gdb
• SUSE update for binutils
• SUSE update for binutils
• SUSE update for binutils
• Anolis OS update for gcc-toolset-12-binutils
• Anolis OS update for binutils