CVE-2017-15022: Null Pointer Dereference
dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DWATname data type, which allows remote attackers to cause a denial of service (bfdhashhash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scanunitforsymbols and parsecompunit.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-15022?
CVE-2017-15022 is a vulnerability in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, that allows remote attackers to cause a denial of service (application crash).
How does CVE-2017-15022 affect the affected software?
CVE-2017-15022 affects the Ubuntu binutils package versions 2.26.1-1ubuntu1~16.04.8+, 2.29.90.20180122-1, and the Debian binutils package versions 2.31.1-16, 2.35.2-2, 2.40-2, and 2.41-5.
How can CVE-2017-15022 be exploited?
CVE-2017-15022 can be exploited by remote attackers by causing a NULL pointer dereference or out-of-bounds access, leading to a denial of service and application crash.
What is the severity of CVE-2017-15022?
The severity of CVE-2017-15022 is high.
Is there a fix available for CVE-2017-15022?
Yes, there are various fixes available depending on the affected software version. Please refer to the provided references for more information on the specific fixes.