CVE-2019-9077

Description

A vulnerability was found in the readelf utility in GNU Binutils. This issue involves a heap-based buffer overflow in the process_mips_specific function, which can be triggered by a malformed MIPS option section in binary files.

Statement

This vulnerability in GNU Binutils is considered moderate. While it involves a heap-based buffer overflow in the process_mips_specific function, successful exploitation requires the attacker to craft a specific malformed MIPS option section within a binary ELF file. This scenario limits the attack vector to files that the user explicitly processes with readelf, rather than making it exploitable through network services or untrusted inputs. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security.

Mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score7.37.8N/A
Attack VectorLocalLocalN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneNoneN/A
User InteractionRequiredRequiredN/A
ScopeUnchangedUnchangedN/A
ConfidentialityLowHighN/A
Integrity ImpactHighHighN/A
Availability ImpactHighHighN/A

Vector

Red Hat: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat CVSS v3 Score Explanation

As explained in detail in the statement section,the successful exploitation will only result in crash of the application itself rather than the system in use,and it is highly unlikely a successful exploitation can even happen considering a user will have to select a malformed MIPs section of an elf, which is why CVSS has been marked as such.

Understanding the Weakness (CWE)

CWE-122

Availability

Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.

Integrity,Confidentiality,Availability,Access Control

Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Modify Memory

Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. For example, object methods in C++ are generally implemented using function pointers. Even in C programs, there is often a global offset table used by the underlying runtime.

Integrity,Confidentiality,Availability,Access Control,Other

Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Other

When the consequence is arbitrary code execution, this can often be used to subvert any other security service.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.