CVE-2021-45078
📋 TL;DR
This vulnerability in GNU Binutils allows attackers to trigger a heap-based buffer overflow via the stab_xcoff_builtin_type function in stabs.c. It can cause denial of service or potentially allow arbitrary code execution. Anyone using affected versions of Binutils tools (like objdump, readelf, or gdb) to process maliciously crafted files is vulnerable.
💻 Affected Systems
- GNU Binutils
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise if exploited through processing of malicious input files.
Likely Case
Denial of service (crash) when processing specially crafted object files or debug information.
If Mitigated
Limited to denial of service if exploit attempts are blocked by security controls.
🎯 Exploit Status
Proof-of-concept exists in the bug report. Exploitation requires the victim to process a malicious file with Binutils tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Binutils 2.38 and later
Vendor Advisory: https://sourceware.org/bugzilla/show_bug.cgi?id=28694
Restart Required: No
Instructions:
1. Update Binutils to version 2.38 or later. 2. For Linux distributions, use package manager: 'sudo apt update && sudo apt upgrade binutils' (Debian/Ubuntu) or 'sudo yum update binutils' (RHEL/CentOS). 3. Recompile any software that statically links Binutils.
🔧 Temporary Workarounds
Restrict file processing
allLimit processing of untrusted object files with Binutils tools.
Use sandboxing
linuxRun Binutils tools in isolated containers or sandboxes when processing untrusted files.
docker run --rm -v $(pwd):/files ubuntu binutils-command /files/untrusted.o
🧯 If You Can't Patch
- Implement strict input validation for files processed by Binutils tools.
- Monitor and log crashes of Binutils-related processes for detection of exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check Binutils version: 'ld --version' or 'objdump --version'. If version is 2.37 or earlier, system is vulnerable.Check Version:
ld --version | head -1Verify Fix Applied:
After update, verify version is 2.38 or later: 'ld --version | head -1'.📡 Detection & Monitoring
Log Indicators:
- Segmentation faults or abnormal termination of Binutils tools (objdump, readelf, ld)
- Core dumps from Binutils processes
Network Indicators:
- Unusual file transfers to systems running Binutils tools
- Uploads of object files to web services that process them
SIEM Query:
process_name IN ('objdump', 'readelf', 'ld', 'gdb') AND exit_code = 139🔗 References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQBH244M5PV6S6UMHUTCVCWFZDX7Y4M6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUHLDDT3HH7YEY6TX7IJRGPJUTNNVEL3/
- https://security.gentoo.org/glsa/202208-30
- https://security.netapp.com/advisory/ntap-20220107-0002/
- https://sourceware.org/bugzilla/show_bug.cgi?id=28694
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=161e87d12167b1e36193385485c1f6ce92f74f02
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQBH244M5PV6S6UMHUTCVCWFZDX7Y4M6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UUHLDDT3HH7YEY6TX7IJRGPJUTNNVEL3/
- https://security.gentoo.org/glsa/202208-30
- https://security.netapp.com/advisory/ntap-20220107-0002/
- https://sourceware.org/bugzilla/show_bug.cgi?id=28694
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=161e87d12167b1e36193385485c1f6ce92f74f02
