CVE-2023-1972

2023-04-1200:00:00

ubuntu.com

heap based buffer overflow

_bfd_elf_slurp_version_tables

availability loss

bugzilla

launchpad

corrupted file

buffer over-read

priority low

untrusted inputs

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

33.9%

JSON

A potential heap based buffer overflow was found in
_bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of
availability.

Bugs

Notes

Author	Note
seth-arnold	binutils isn’t safe for untrusted inputs.
mdeslaur	buffer over-read, likely just a crash when parsing a corrupted file, setting priority to low

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchbinutils< 2.38-4ubuntu2.2UNKNOWN
ubuntu22.10noarchbinutils< 2.39-3ubuntu1.2UNKNOWN
ubuntu23.04noarchbinutils< 2.40-2ubuntu4.1UNKNOWN
ubuntu23.10noarchbinutils< 2.40-2ubuntu6UNKNOWN
ubuntu24.04noarchbinutils< 2.40-2ubuntu6UNKNOWN
ubuntu18.04noarchgdb< 8.1.1-0ubuntu1+esm1UNKNOWN
ubuntu20.04noarchgdb< 9.2-0ubuntu1~20.04.2UNKNOWN
ubuntu22.04noarchgdb< 12.1-0ubuntu1~22.04.2UNKNOWN
ubuntu16.04noarchgdb< 7.11.1-0ubuntu1~16.5+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	binutils	< 2.38-4ubuntu2.2	UNKNOWN
ubuntu	22.10	noarch	binutils	< 2.39-3ubuntu1.2	UNKNOWN
ubuntu	23.04	noarch	binutils	< 2.40-2ubuntu4.1	UNKNOWN
ubuntu	23.10	noarch	binutils	< 2.40-2ubuntu6	UNKNOWN
ubuntu	24.04	noarch	binutils	< 2.40-2ubuntu6	UNKNOWN
ubuntu	18.04	noarch	gdb	< 8.1.1-0ubuntu1+esm1	UNKNOWN
ubuntu	20.04	noarch	gdb	< 9.2-0ubuntu1~20.04.2	UNKNOWN
ubuntu	22.04	noarch	gdb	< 12.1-0ubuntu1~22.04.2	UNKNOWN
ubuntu	16.04	noarch	gdb	< 7.11.1-0ubuntu1~16.5+esm1	UNKNOWN

References

access.redhat.com/security/cve/CVE-2023-1972

launchpad.net/bugs/cve/CVE-2023-1972

nvd.nist.gov/vuln/detail/CVE-2023-1972

security-tracker.debian.org/tracker/CVE-2023-1972

sourceware.org/git/?p=binutils-gdb.git;a=blobdiff;f=bfd/elf.c;h=185028cbd97ae0901c4276c8a4787b12bb75875a;hp=027d01437352555bc4ac0717cb0486c751a7775d;hb=c22d38baefc5a7a1e1f5cdc9dbb556b1f0ec5c57;hpb=f2f9bde5cde7ff34ed0a4c4682a211d402aa1086

ubuntu.com/security/notices/USN-6101-1

ubuntu.com/security/notices/USN-6842-1

www.cve.org/CVERecord?id=CVE-2023-1972