Vulmon
Amazon Linux 2 Security Advisory: ALAS-2021-1702
Advisory Release Date: 2021-09-08 23:35 Pacific
Advisory Updated Date: 2021-09-15 17:42 Pacific
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)
A flaw was found in binutils' readelf program. An attacker who is able to convince a victim using readelf to read a crafted file, could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability. (CVE-2021-20294)
There's a flaw in the BFD library of binutils. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption. (CVE-2021-3487)
Affected Packages:
gcc10-binutils
Issue Correction:
Run yum update gcc10-binutils to update your system.
aarch64:
gcc10-binutils-2.35-21.amzn2.0.1.aarch64
gcc10-binutils-devel-2.35-21.amzn2.0.1.aarch64
gcc10-binutils-gold-2.35-21.amzn2.0.1.aarch64
gcc10-binutils-debuginfo-2.35-21.amzn2.0.1.aarch64
i686:
gcc10-binutils-2.35-21.amzn2.0.1.i686
gcc10-binutils-devel-2.35-21.amzn2.0.1.i686
gcc10-binutils-gold-2.35-21.amzn2.0.1.i686
gcc10-binutils-debuginfo-2.35-21.amzn2.0.1.i686
src:
gcc10-binutils-2.35-21.amzn2.0.1.src
x86_64:
gcc10-binutils-2.35-21.amzn2.0.1.x86_64
gcc10-binutils-devel-2.35-21.amzn2.0.1.x86_64
gcc10-binutils-gold-2.35-21.amzn2.0.1.x86_64
gcc10-binutils-debuginfo-2.35-21.amzn2.0.1.x86_64