CVE-2021-46174
📋 TL;DR
CVE-2021-46174 is a heap-based buffer overflow vulnerability in the bfd_getl32 function of Binutils objdump version 2.37. This vulnerability allows attackers to execute arbitrary code or cause denial of service by processing specially crafted object files. Users and systems that process untrusted object files with vulnerable versions of objdump are affected.
💻 Affected Systems
- GNU Binutils
- objdump
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the user running objdump, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) when processing malicious object files.
If Mitigated
Limited impact if objdump is not used to process untrusted files or runs with minimal privileges.
🎯 Exploit Status
Exploitation requires the attacker to provide a malicious object file that the victim processes with objdump. Proof-of-concept code is available in the bug reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Binutils 2.37 with patch or later versions (2.38+)
Vendor Advisory: https://sourceware.org/bugzilla/show_bug.cgi?id=28753
Restart Required: No
Instructions:
1. Update Binutils package from your distribution's repositories. 2. For source installations: download patched source from GNU mirrors, compile, and install. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Restrict objdump usage
linuxLimit objdump execution to trusted users and avoid processing untrusted object files.
chmod 750 /usr/bin/objdump
setfacl -m u:trusteduser:rx /usr/bin/objdump
Use alternative tools
allUse readelf or other binary analysis tools instead of objdump when possible.
🧯 If You Can't Patch
- Run objdump with minimal privileges (non-root user, restricted capabilities)
- Implement strict input validation for object files before processing with objdump
🔍 How to Verify
Check if Vulnerable:
Check if objdump version is 2.37 and if the system processes untrusted object files.Check Version:
objdump --version | head -1Verify Fix Applied:
Verify objdump version is 2.38+ or confirm with distribution that patch is applied.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from objdump process
- Unexpected objdump execution with suspicious file arguments
Network Indicators:
- Unusual outbound connections after objdump execution
- File transfers of object files to untrusted sources
SIEM Query:
process_name:"objdump" AND (event_type:"crash" OR file_path:"*.o" OR file_path:"*.obj")