CVE-2017-8392: Null Pointer Dereference

Published May 1, 2017

Updated

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the bfddwarf2findnearestline function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.

Affected Software

1 affected component

GNU binutils=2.28

Remediation

Patch Available

https://sourceware.org/bugzilla/show_bug.cgi?id=21409

Event History

May 1, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2017-8392?

CVE-2017-8392 has been classified as a medium severity vulnerability.

How do I fix CVE-2017-8392?

To fix CVE-2017-8392, you should upgrade the GNU Binutils library to version 2.29 or later.

What is the impact of CVE-2017-8392?

The impact of CVE-2017-8392 includes potential crashes or unintended behavior in applications using the affected BFD library.

Which versions of GNU Binutils are affected by CVE-2017-8392?

CVE-2017-8392 affects GNU Binutils version 2.28.

Is CVE-2017-8392 reversible once exploited?

Once exploited, the effects of CVE-2017-8392 may not be reversible without addressing the root cause through appropriate software updates.