CVE-2021-3549: Buffer Overflow
First published: Fri May 14 2021(Updated: )
A flaw was discovered in objdump as distributed in GNU Binutils version 2.36. A large section parameter can be passed to avr_elf32_load_records_from_section() leading to DoS and memory corruption. Reference: <a href="https://sourceware.org/bugzilla/show_bug.cgi?id=27294">https://sourceware.org/bugzilla/show_bug.cgi?id=27294</a> Upstream patch: <a href="https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1cfcf3004e1830f8fe9112cfcd15285508d2c2b7">https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1cfcf3004e1830f8fe9112cfcd15285508d2c2b7</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU Binutils | =2.36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1960717
- https://security.gentoo.org/glsa/202208-30
- https://sourceware.org/bugzilla/show_bug.cgi?id=27294
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1cfcf3004e1830f8fe9112cfcd15285508d2c2b7
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1960718
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1960719
- https://access.redhat.com/security/cve/cve-2021-3549
Frequently Asked Questions
What is the vulnerability ID for this out of bounds flaw in GNU binutils objdump utility?
The vulnerability ID is CVE-2021-3549.
What is the affected software for this vulnerability?
The affected software is GNU Binutils version 2.36.
What is the severity of CVE-2021-3549?
The severity of CVE-2021-3549 is high, with a severity value of 7.1.
How can an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by passing a large section to avr_elf32_load_records_from_section(), potentially resulting in a crash or memory corruption.
Are there any references available for this vulnerability?
Yes, you can find references for this vulnerability at the following links: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=1960717) and [link2](https://security.gentoo.org/glsa/202208-30).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3549
- agent/author
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/remedy
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/gnu
- canonical/gnu binutils
- version/gnu binutils/2.36