CVE-2017-13757 - Out-of-bounds Read

Severity

43%

Complexity

86%

Confidentiality

48%

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.

CVSS 3.0 Base Score 5.5. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P).

Demo Examples

Out-of-bounds Read

CWE-125

In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the method


               }
                     return value;// check that the array index is less than the maximum// length of the array
                           value = array[index];// get the value at the specified index of the array
// if array index is invalid then output error message// and return value indicating errorvalue = -1;

However, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below.


               ...// check that the array index is within the correct// range of values for the array

Overview

First reported 7 years ago

2017-08-29 23:29:00

Last updated 5 years ago

2019-10-03 00:03:00

Affected Software

GNU Binutils 2.29

2.29

References

100532

https://sourceware.org/bugzilla/show_bug.cgi?id=22018

Issue Tracking, Patch, Third Party Advisory

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=90efb6422939ca031804266fba669f77c22a274a