High severity · published Sep 14, 2023
CVE-2023-25584
Out of bounds read in parse_module function in bfd/vms-alpha.c
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
BI
Binutils · Gnu
before 2.40 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25584
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25584
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-25584
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2167467
Third Party Advisory
https://security.netapp.com/advisory/ntap-20231103-0002/
Mailing List
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=77c225bdeb410cf60da804879ad41622f5f1aa44
More from binutils
6.1
CVE-2020-35494
There's a flaw in binutils /opcodes/tic4x-dis.c
5.5
CVE-2023-25585
Field `file_table` of `struct module *module` is uninitialized
5.5
CVE-2023-25586
Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized
5.5
CVE-2023-25588
Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`
5.5
CVE-2020-35507
There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able to submit a crafted file to be…