CVE-2018-7568: Integer Overflow
A flaw was found in the parsedie function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils up to version 2.30, when compiled in 32bit mode. This vulnerability allows attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupted dwarf1 debug information.
References: https://sourceware.org/bugzilla/showbug.cgi?id=22894
Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eef104664efb52965d85a28bc3fc7c77e52e48e2
Other sources
The parsedie function in dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (integer overflow and application crash) via an ELF file with corrupt dwarf1 debug information, as demonstrated by nm.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3 - Upgrade
Upgrade
GNU Binutils (libbfd)to a version that resolves this vulnerability.Fixed in 2.30 - Compensating control
Mitigate exposure by preventing untrusted/remote users from causing GNU Binutils/libbfd to process attacker-supplied ELF files containing corrupted dwarf1 debug information (e.g., restrict who can upload/provide files for analysis to trusted users, and isolate the processing environment).
Event History
Frequently Asked Questions
What is CVE-2018-7568?
CVE-2018-7568 is a vulnerability in the Binary File Descriptor (BFD) library (aka libbfd) that allows remote attackers to cause a denial of service via an ELF file with corrupt dwarf1 debug information.
How does CVE-2018-7568 impact my system?
CVE-2018-7568 can lead to a denial of service (integer overflow and application crash) if an attacker exploits the vulnerability using a malicious ELF file.
Which versions of binutils are affected by CVE-2018-7568?
The affected versions of binutils include 2.26.1-1ubuntu1~16.04.8+ and 2.30-6.
How can I fix CVE-2018-7568?
To fix CVE-2018-7568, update to binutils version 2.31.1-16, 2.35.2-2, 2.40-2, or 2.41-5, depending on your operating system.
What is the severity of CVE-2018-7568?
CVE-2018-7568 has a low severity with a CVSS score of 4.3.