CVE-2022-47695
📋 TL;DR
A vulnerability in Binutils objdump allows attackers to cause denial of service or potentially other impacts via a specific function in match-o.c. This affects systems using vulnerable versions of Binutils objdump to process malicious Mach-O files. Users and automated systems that process untrusted Mach-O files are at risk.
💻 Affected Systems
- Binutils
- objdump
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if the vulnerability enables memory corruption beyond DoS.
Likely Case
Denial of service through application crash when processing malicious Mach-O files.
If Mitigated
Limited impact if systems don't process untrusted Mach-O files or have proper input validation.
🎯 Exploit Status
Exploitation requires crafting malicious Mach-O files and getting them processed by vulnerable objdump. No public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.39.3 and later
Vendor Advisory: https://sourceware.org/bugzilla/show_bug.cgi?id=29846
Restart Required: No
Instructions:
1. Update Binutils to version 2.39.3 or later. 2. Recompile any applications using Binutils libraries. 3. Replace vulnerable objdump binary with patched version.
🔧 Temporary Workarounds
Restrict objdump usage
linuxLimit objdump execution to trusted users and avoid processing untrusted Mach-O files.
chmod 750 /usr/bin/objdump
setfacl -m u:trusteduser:rx /usr/bin/objdump
Input validation
linuxImplement file type verification before processing with objdump.
file --mime-type inputfile | grep -q 'application/x-mach-binary' && echo 'Mach-O file detected'
🧯 If You Can't Patch
- Isolate systems using objdump on untrusted inputs in restricted network segments.
- Implement strict access controls and monitoring for objdump usage patterns.
🔍 How to Verify
Check if Vulnerable:
Check objdump version: objdump --version | head -1Check Version:
objdump --version | head -1Verify Fix Applied:
Verify version is 2.39.3 or later: objdump --version | grep -q '2.39.3\|2.4'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from objdump processes
- Unusual objdump execution patterns
Network Indicators:
- Unexpected file transfers to systems running objdump
SIEM Query:
process.name:objdump AND event.action:crash