CVE-2023-1972 is a medium-severity vulnerability affecting GNU Binutils software, specifically versions 2.35 to 2.40. This potential heap-based buffer overflow can lead to loss of availability in systems using these versions of GNU Binutils. The vulnerability is found in the _bfd_elf_slurp_version_tables() function in bfd/elf.c and can cause a program to terminate with a segmentation fault when triggered. Systems running the Linux operating system and using the affected versions of GNU Binutils are potentially at risk.

How do I know if I'm affected?

If you're using GNU Binutils software, specifically versions 2.35 to 2.40, you might be affected by the vulnerability. This issue can cause a program to terminate with a segmentation fault when triggered. It mainly affects programs that use the BFD library to load ELF symbol version information and requires corrupt input to trigger the bug. To check if you're affected, you can look for signs of illegal memory access when accessing a zero-length version definition table. Keep in mind that this vulnerability is considered medium-severity and can lead to loss of availability in your system.

What should I do if I'm affected?

If you're affected by the vulnerability, the recommended course of action is to upgrade your GNU Binutils software to the latest version, specifically version 2.40 or higher. This can help prevent potential heap-based buffer overflow issues and protect your system from loss of availability. For detailed instructions on upgrading, consult your system's documentation or seek assistance from your IT administrator.

Is CVE-2023-1972 in CISA’s Known Exploited Vulnerabilities Catalog?

As of now, CVE-2023-1972 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This medium-severity vulnerability is a heap-based buffer overflow issue found in GNU Binutils software, specifically versions 2.35 to 2.40. Upgrading to version 2.40 or higher can help prevent potential issues and protect your system from loss of availability.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787 and CWE-119, which involves out-of-bounds write and improper restriction of operations within memory buffers that can lead to loss of availability. Upgrading to the latest software version can help prevent issues.

For more details

CVE-2023-1972 is a medium-severity vulnerability affecting GNU Binutils software, with potential heap-based buffer overflow issues that can lead to loss of availability. To learn more about this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• CVE-2023-1972 binutils: Illegal memory access when accessing a zero-length version definition table

• GNU Binutils: Multiple Vulnerabilities (GLSA 202309-15)

• 30285 – objdump heap-buffer-overflow in _bfd_elf_print_private_bfd_data() at /binutils-gdb/bfd/elf.c:1844 (SIGSEGV)