GNU Binutils Memory Corruption Vulnerability in ld Component

A memory corruption vulnerability has been identified in GNU Binutils version 2.43, specifically within the ld component's bfd_putl64 function in libbfd.c. This vulnerability allows for illegal write access, leading to a segmentation fault and a crash of the linker. The issue can be exploited remotely, although the complexity of the attack is considered high.

Impact

Exploitation of this vulnerability causes a segmentation fault due to illegal memory writes, leading to a crash of the affected application.

Reproduction

The vulnerability can be reproduced by building GNU Binutils 2.43 with AddressSanitizer enabled. After compiling the program, the ld command can be executed with the --version-exports-section and --shared options, along with a specially crafted input file that triggers the illegal memory access. The AddressSanitizer will report a segmentation fault, indicating the occurrence of the vulnerability.

Remediation

Users are advised to update to a version of GNU Binutils that includes the patch for this vulnerability.