oss-security - CVE Request: multiple bugs found in BFD libraries and Binutils' utilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMNd5sthm7v3xxeZvpd6WBXQoM8OJsst+AWK9jQinzkM-VbZiw@mail.gmail.com>
Date: Fri, 17 Mar 2017 00:58:05 +0800
From: Thuan Pham <thuanpv@...p.nus.edu.sg>
To: oss-security@...ts.openwall.com
Subject: CVE Request: multiple bugs found in BFD libraries and Binutils' utilities

Dear all,

Using AFLGo, a directed version of AFL/AFLFast fuzzing tool, we found
several bugs in the Binutils' utilities such as readelf, objdump, nm and
the BFD library (DWARF and STABS parsers).

Binary File Descriptor (BFD) library is a GNU library to manipulate object
files of many processor architecture (>=25) in a variety of formats (>=50).
The library is used by several widely-used tools like GNU Assembler (GAS),
GNU Linker (GLD), GNU Binary Utilities ("binutils") tools, and the GNU
Debugger (GDB). Binutils' utilities like readelf, objdump and nm are common
tools to analyze program objects..

Here is the list of bug reports & bug fixes. All of them have been
confirmed and fixed by Binutils' maintainers.

1) Heap Buffer Overflow - Invalid Write in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21137
https://sourceware.org/bugzilla/show_bug.cgi?id=21155 (bug still exists
because of incomplete fix in PR Binutils/21137)

2) Heap Buffer Overflow - Invalid Read in BFD library's DWARF
https://sourceware.org/bugzilla/show_bug.cgi?id=21151

3) Heap Buffer Overflow - Invalid Read in BFD library's handling of STABS
debug information causing Objdump to crash
https://sourceware.org/bugzilla/show_bug.cgi?id=21157

4) Global Buffer Overflow - Invalid Read in BFD library's handling of STABS
debug information
https://sourceware.org/bugzilla/show_bug.cgi?id=21158

5) Use after free in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21139

6) Heap buffer overflow - invalid read of size 4 in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21156

7) Heap buffer overflow in Readelf (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21135
https://sourceware.org/bugzilla/show_bug.cgi?id=21159 (bug still exists due
to incomplete fix in PR Binutils/21135)

8) Heap buffer overflow in Readelf (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21147

9) Heap buffer overflow in Readelf (Multiple Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21148

10) Heap buffer overflow in Readelf (Multiple Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21149

11) Global buffer overflow in Nm (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21150

Could you please check whether these bugs are suitable for CVEs?
Many thanks,

----------------------------
Thuan Pham
TSUNAMi Security Research Center
National University of Singapore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.