CVE-2021-3487: Input Validation
REJECT Non Security Issue. See the binutils security policy for more details, https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt
Other sources
readsection() in dwarf2.c of BFD could cause excessive memory consumption when handling corrupt DWARF debug sections. This could lead to an impact to system availability, denial of service, and/or a crash in applications linked with the BFD library's DWARF functionality if they parse files from untrusted sources.
Reference: https://sourceware.org/bugzilla/showbug.cgi?id=26946
Upstream patch commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=647cebce12a6b0a26960220caff96ff38978cf24
— Red Hat
Rejected reason: Non Security Issue. See the binutils security policy for more details, https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt
There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3487?
CVE-2021-3487 is a vulnerability in the BFD library of binutils before version 2.36 that allows an attacker to cause excessive memory consumption.
How does CVE-2021-3487 impact system availability?
CVE-2021-3487 can impact system availability by causing excessive memory consumption.
Which versions of binutils are affected by CVE-2021-3487?
Versions before 2.36 of binutils are affected by CVE-2021-3487.
How can I fix CVE-2021-3487?
To fix CVE-2021-3487, update binutils to version 2.36 or later.
Where can I find more information about CVE-2021-3487?
You can find more information about CVE-2021-3487 on the MITRE CVE database and the Ubuntu security notices.