CVE-2018-10535: Null Pointer Dereference
A flaw was found in the ignoresectionsym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the outputsection pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
References: https://sourceware.org/bugzilla/showbug.cgi?id=23113
Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=db0c309f4011ca94a4abc8458e27f3734dab92ac
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-10535.
What is the severity level of CVE-2018-10535?
The severity level of CVE-2018-10535 is low.
How does the ignore_section_sym function in elf.c contribute to the vulnerability?
The ignore_section_sym function in elf.c does not validate the output_section pointer in the case of a symtab entry with a "SECTION" type that has a "0" value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash).
Which version of GNU Binutils is affected by CVE-2018-10535?
GNU Binutils version 2.30 is affected by CVE-2018-10535.
How can I fix CVE-2018-10535?
Update to version 2.30.90.20180627-1 or later of binutils.