CVE-2023-25586: Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized
A flaw was found in Binutils. A logic fail in the bfdinitsectiondecompressstatus function may lead to the use of an uninitialized variable that can cause a crash and local denial of service.
Other sources
In Binutils, at function bfdinitsectiondecompressstatus, a local variable is supposed to be initialized by function bfdcheckcompressionheader. However, since this function call is inside an else if branch, if the previous if branch is taken, the chtype can be uninitialized and thus directly used to assign sec->compressstatus. Therefore, when the compressstatus field is used in a branch condition, the memory sanitizer aborts.
Upstream bug:
https://sourceware.org/bugzilla/showbug.cgi?id=29855
Upstream fix:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in Binutils?
The vulnerability ID for this flaw in Binutils is CVE-2023-25586.
What is the severity of CVE-2023-25586?
CVE-2023-25586 has a severity level of medium (5.5).
Which version of Binutils is affected by CVE-2023-25586?
Binutils version 2.40 is affected by CVE-2023-25586.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-908 and CWE-457.
How can this vulnerability in Binutils be exploited?
This vulnerability in Binutils can be exploited by causing a crash and local denial of service through the use of an uninitialized variable.