REDHAT-BUG-2460006: High severity GNU binutils vulnerability
Heap-buffer-overflow WRITE in xcofflinkaddsymbols() in bfd/xcofflink.c. Triggered by malformed XCOFF object file during linking. Fixed upstream by Alan Modra.
Public reference: https://sourceware.org/bugzilla/showbug.cgi?id=34049 Affects binutils <= 2.46.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
When linking, avoid processing untrusted/malformed XCOFF object files (xcoff) that could trigger the heap-buffer-overflow in xcoff_link_add_symbols() during linking.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2460006?
The severity of REDHAT-BUG-2460006 is high due to the potential for remote code execution through a heap buffer overflow.
How do I fix REDHAT-BUG-2460006?
To fix REDHAT-BUG-2460006, upgrade to binutils version higher than 2.46.
What causes REDHAT-BUG-2460006?
REDHAT-BUG-2460006 is caused by a heap buffer overflow triggered by a malformed XCOFF object file during linking.
Which versions of software are affected by REDHAT-BUG-2460006?
REDHAT-BUG-2460006 affects GNU Binutils version 2.46 and earlier.
Who fixed REDHAT-BUG-2460006?
REDHAT-BUG-2460006 was fixed upstream by Alan Modra.