CVE-2018-8945: Input Validation
binutils through version 2.30 has a vulnerability in the elf.c:bfdsectionfromshdr() functionof the Binary File Descriptor (BFD) library (aka libbfd). An attacker could exploit this with a crafted executable file to cause a crash.
Upstream Bug:
https://sourceware.org/bugzilla/showbug.cgi?id=22809
Upstream Patch:
https://sourceware.org/bugzilla/attachment.cgi?id=10814&action=diff
Other sources
The bfdsectionfromshdr function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (segmentation fault) via a large attribute section.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3 - Upgrade
Upgrade
GNU Binutils (libbfd)to a version that resolves this vulnerability.Fixed in 2.30
Event History
Frequently Asked Questions
What is CVE-2018-8945?
CVE-2018-8945 is a vulnerability in the Binary File Descriptor (BFD) library, also known as libbfd, which can cause a denial of service attack by triggering a segmentation fault.
How does CVE-2018-8945 impact affected software?
CVE-2018-8945 can cause a denial of service (segmentation fault) on systems running GNU Binutils 2.30 or earlier versions.
How severe is CVE-2018-8945?
CVE-2018-8945 has a low severity level.
Which versions of binutils are affected by CVE-2018-8945?
GNU Binutils 2.30 and earlier versions are affected by CVE-2018-8945.
How can I fix CVE-2018-8945?
To fix CVE-2018-8945, update to GNU Binutils version 2.30.90.20180627-1 or later.