CVE-2017-8393 Memory corruption in n/a
A global buffer over-read in the BFD library causes crashes in tools like objcopy and strip when processing specific binary sections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-8393?
CVE-2017-8393 is a high-severity memory corruption vulnerability in Gnu Binutils, published on 1 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.
Weakness: CWE-125
Which versions are affected by CVE-2017-8393?
It affects 1 product.
Products include Gnu Binutils.
How do I fix CVE-2017-8393?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-8393 being exploited?
There is no known exploitation of CVE-2017-8393 in the wild and no public exploit code.
Other vulnerabilities in Gnu Binutils
Sources
Also known as DEBIAN-CVE-2017-8393, GHSA-8h8p-qhmc-f4wr, UBUNTU-CVE-2017-8393.