Bug 711324 (CVE-2019-17450, CVE-2019-17451)

Summary:	<sys-devel/binutils-2.33.1: Multiple vulnerabilities (CVE-2019-{14444,17450,17451})
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://sourceware.org/bugzilla/show_bug.cgi?id=24829
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=690590
Whiteboard:	A3 [glsa+ cve masked]
Package list:		Runtime testing required:	---

Description Sam James archtester

2020-03-02 15:11:02 UTC

Description:
"apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf."

Patch: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=afc72f154d6c59367e2f1cdf3ead5035748e2b61

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2020-04-17 21:09:07 UTC

CVE-2019-17451 (https://nvd.nist.gov/vuln/detail/CVE-2019-17451):
  An issue was discovered in the Binary File Descriptor (BFD) library (aka
  libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow
  leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as
  demonstrated by nm.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2020-04-17 21:09:36 UTC

CVE-2019-17450 (https://nvd.nist.gov/vuln/detail/CVE-2019-17450):
  find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD)
  library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote
  attackers to cause a denial of service (infinite recursion and application
  crash) via a crafted ELF file.

Comment 3 Larry the Git Cow gentoo-dev

2020-04-26 00:33:52 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cf7bc8cee05a4dd95af28b48b66dd5a93e48a5c8

commit cf7bc8cee05a4dd95af28b48b66dd5a93e48a5c8
Author:     Andreas K. Hüttel <dilfridge@gentoo.org>
AuthorDate: 2020-04-26 00:32:31 +0000
Commit:     Andreas K. Hüttel <dilfridge@gentoo.org>
CommitDate: 2020-04-26 00:33:36 +0000

    package.mask: Mask <binutils-2.33.1, bug 711324
    
    Bug: https://bugs.gentoo.org/711324
    Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>

 profiles/package.mask | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comment 4 Andreas K. Hüttel archtester

2020-04-26 00:34:46 UTC

No cleanup, but all masked.

Comment 5 Sam James archtester

2020-04-26 00:40:47 UTC

(In reply to Andreas K. Hüttel from comment #4)
> No cleanup, but all masked.

Good enough for toolchain stuff. Thanks.

Comment 6 GLSAMaker/CVETool Bot gentoo-dev

2020-07-27 00:51:42 UTC

This issue was resolved and addressed in
 GLSA 202007-39 at https://security.gentoo.org/glsa/202007-39
by GLSA coordinator Sam James (sam_c).