CVE-2021-3549: Buffer Overflow
A flaw was discovered in objdump as distributed in GNU Binutils version 2.36. A large section parameter can be passed to avrelf32loadrecordsfromsection() leading to DoS and memory corruption.
Reference: https://sourceware.org/bugzilla/showbug.cgi?id=27294
Upstream patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1cfcf3004e1830f8fe9112cfcd15285508d2c2b7
Other sources
An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avrelf32loadrecordsfromsection() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this out of bounds flaw in GNU binutils objdump utility?
The vulnerability ID is CVE-2021-3549.
What is the affected software for this vulnerability?
The affected software is GNU Binutils version 2.36.
What is the severity of CVE-2021-3549?
The severity of CVE-2021-3549 is high, with a severity value of 7.1.
How can an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by passing a large section to avr_elf32_load_records_from_section(), potentially resulting in a crash or memory corruption.
Are there any references available for this vulnerability?
Yes, you can find references for this vulnerability at the following links: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=1960717) and [link2](https://security.gentoo.org/glsa/202208-30).