CVE-2020-35448 - binutils: Heap-based buffer overflow in bfd_getl_signed_32() in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section() in elf.c

Back Back to CVE browser

LOW

binutils: Heap-based buffer overflow in bfd_getl_signed_32() in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section() in elf.c

Published Dec 27, 2020

3.3

LOW

CVSS 3.1

EPSS 1.24%

Description

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.

Affected products

Red Hat Enterprise Linux 8

binutils-0:2.30-108.el8

Fixed · RHSA-2021:4364
Red Hat Enterprise Linux 8

binutils-0:2.30-108.el8

Fixed · RHSA-2021:4364
Red Hat Enterprise Linux 6

binutils

Out of support scope
Red Hat Enterprise Linux 7

binutils

Out of support scope
Red Hat Enterprise Linux 8

gcc-toolset-10-binutils

Fix deferred
Red Hat Enterprise Linux 8

gcc-toolset-9-binutils

Not affected
Red Hat Enterprise Linux 9

binutils

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	binutils-0:2.30-108.el8	Fixed	RHSA-2021:4364
Red Hat Enterprise Linux 8	binutils-0:2.30-108.el8	Fixed	RHSA-2021:4364
Red Hat Enterprise Linux 6	binutils	Out of support scope	n/a
Red Hat Enterprise Linux 7	binutils	Out of support scope	n/a
Red Hat Enterprise Linux 8	gcc-toolset-10-binutils	Fix deferred	n/a
Red Hat Enterprise Linux 8	gcc-toolset-9-binutils	Not affected	n/a
Red Hat Enterprise Linux 9	binutils	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-125

Out-of-bounds Read

References (9)

https://access.redhat.com/security/cve/CVE-2020-35448
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1950478
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23122
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-35448
https://security.gentoo.org/glsa/202107-24
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20210129-0008/
x_refsource_CONFIRMThird Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=26574
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=8642dafaef21aa6747cec01df1977e9c52eb4679
x_refsource_MISC
https://www.cve.org/CVERecord?id=CVE-2020-35448

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2020-35448		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1950478		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-23122		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-35448
https://security.gentoo.org/glsa/202107-24		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.netapp.com/advisory/ntap-20210129-0008/		x_refsource_CONFIRMThird Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=26574		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=8642dafaef21aa6747cec01df1977e9c52eb4679		x_refsource_MISC
https://www.cve.org/CVERecord?id=CVE-2020-35448