REDHAT-BUG-2399948: Buffer Overflow
A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elfswapshdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with "[f]ixed for 2.46".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Binutilsto a version that resolves this vulnerability.Fixed in 2.46Patch 9ca499644a21ceb3f946d1c179c38a83be084490 - Compensating control
Because the attack must be carried out locally, restrict local access to systems running the vulnerable GNU Binutils/Linker component to trusted users and environments (e.g., least-privilege and tighter host access controls).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2399948?
The severity of REDHAT-BUG-2399948 is considered critical due to the potential for a heap-based buffer overflow.
How do I fix REDHAT-BUG-2399948?
To fix REDHAT-BUG-2399948, upgrade GNU Binutils to a version higher than 2.45 that addresses this vulnerability.
What systems are affected by REDHAT-BUG-2399948?
REDHAT-BUG-2399948 affects GNU Binutils version 2.45.
Can REDHAT-BUG-2399948 be exploited remotely?
No, REDHAT-BUG-2399948 requires local access for exploitation.
What are the potential impacts of REDHAT-BUG-2399948?
The potential impacts of REDHAT-BUG-2399948 include arbitrary code execution and system compromise through heap-based buffer overflow.