REDHAT-BUG-1664699: Integer Overflow
An integer overflow was found in objdump, bfdgetdynamicrelocupperbound and bfdcanonicalizedynamicreloc functions of binutils. A local attacker could use this to crash the application or potentially achieve code execution.
Upstream issue:
https://sourceware.org/bugzilla/showbug.cgi?id=23994
Upstream patch:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=3a551c7a1b80fca579461774860574eabfd7f18f
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems where a local attacker can invoke objdump on attacker-controlled input are exposed. The issue is in GNU binutils functions used when handling dynamic relocations.
What does an attacker need to exploit it?
An attacker needs local access and needs to cause objdump to process crafted data that triggers the integer overflow in dynamic relocation handling. Successful exploitation could crash the application and may potentially lead to code execution.
What can be done if patching is not immediately possible?
Limit untrusted users' ability to run objdump against attacker-supplied files, especially files that may contain crafted dynamic relocation data. This reduces the local attack opportunity described for this issue.