CVE-2018-7208: Input Validation
In GNU Binutils through version 2.30, the coffpointerizeaux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), an index is not properly validated, allowing an attacker to cause a denial of service via a crash (segmentation fault) when parsing a file with a crafted COFF file.
Upstream Issue:
https://sourceware.org/bugzilla/showbug.cgi?id=22741
Upstream Patch:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eb77f6a4621795367a39cdd30957903af9dbb815
Other sources
In the coffpointerizeaux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3 - Upgrade
Upgrade
redhat/binutilsto a version that resolves this vulnerability.Fixed in 2.31
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-7208.
What is the severity of CVE-2018-7208?
The severity of CVE-2018-7208 is low.
How does CVE-2018-7208 impact the affected software?
CVE-2018-7208 can cause a denial of service (segmentation fault) or possibly have unspecified other impact.
Which versions of binutils are affected by CVE-2018-7208?
Binutils versions 2.26.1-1ubuntu1~16.04.8+ and 2.30-6 are affected by CVE-2018-7208.
How do I fix CVE-2018-7208?
To fix CVE-2018-7208, update the binutils package to version 2.31 or higher.