CVE-2019-17450 — Uncontrolled Recursion in Binutils

CWE-674 — Uncontrolled RecursionCWE-835 — Infinite Loop14 documents9 sources
Severity
6.5MEDIUMNVD
EPSS
1.1%
top 22.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GNU BinutilsCanonical Ubuntu LinuxOpensuse Leap
Timeline
PublishedOct 10
Latest updateMay 24

Description

find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶Debiangnu/binutils< 2.34-1+3
▶NVDgnu/binutils2.32
▶NVDopensuse/leap15.1, 15.2+1

Also affects: Ubuntu Linux 18.04

🔴Vulnerability Details

3
GHSA
GHSA-8c3q-4m86-34f8: find_abstract_instance in dwarf2↗2022-05-24
▶
OSV
CVE-2019-17450: find_abstract_instance in dwarf2↗2019-10-10
▶
CVEList
CVE-2019-17450: find_abstract_instance in dwarf2↗2019-10-10
▶

📋Vendor Advisories

5
Ubuntu
GNU binutils vulnerabilities↗2021-07-21
▶
Ubuntu
GNU binutils vulnerabilities↗2020-04-22
▶
Red Hat
binutils: denial of service via crafted ELF file↗2019-10-08
▶
Microsoft
find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.32 allows remote attackers to cause a denial of service (infinite recursion↗2019-10-08
▶
Debian
CVE-2019-17450: binutils - find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (...↗2019
▶

💬Community

5
Bugzilla
CVE-2019-17450 binutils: denial of service via crafted ELF file↗2019-11-12
▶
Bugzilla
CVE-2019-17450 mingw-binutils: binutils: denial of service via crafted ELF file [epel-6]↗2019-11-12
▶
Bugzilla
CVE-2019-17450 binutils: denial of service via crafted ELF file [fedora-all]↗2019-11-12
▶
Bugzilla
CVE-2019-17450 mingw-binutils: binutils: denial of service via crafted ELF file [fedora-all]↗2019-11-12
▶
Bugzilla
CVE-2019-17450 mingw-binutils: binutils: denial of service via crafted ELF file [epel-7]↗2019-11-12
▶
CVE-2019-17450 — Uncontrolled Recursion in GNU Binutils | cvebase