Hao Wangによる報告：

2.36より前のバージョンのbinutilsのBFDライブラリに欠陥があります。
攻撃者が、BFDにリンクされたアプリケーションに細工されたファイルを提供し、DWARF機能を使用すると、過剰なメモリ消費によりシステムの可用性に影響を与える可能性があります。

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35507)

  - A flaw was found in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35496)

  - A flaw was found in binutils. An attacker who is able     to submit a crafted input file to be processed by the     objdump program could cause a null pointer dereference.
    The greatest threat from this flaw is to application     availability.(CVE-2020-35495)

  - There's a flaw in the BFD library of binutils. An     attacker who supplies a crafted file to an application     linked with BFD, and using the DWARF functionality,     could cause an impact to system availability by way of     excessive memory consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hao Wang reports :

There's a flaw in the BFD library of binutils in versions before 2.36.
An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption.

An update of the crash package has been released.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

  - Not found.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - There's a flaw in the BFD library of binutils. An     attacker who supplies a crafted file to an application     linked with BFD, and using the DWARF functionality,     could cause an impact to system availability by way of     excessive memory consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the binutils package has been released.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
152668	FreeBSD：binutils -- 過剰なデバッグセクションサイズにより、bfdのdwarf2.c read_section()で過剰なメモリ消費が引き起こされる可能性があります（f4c54b81-bcc8-11eb-a7a6-080027f515ea）	Nessus	FreeBSD Local Security Checks	2021/8/19	2021/8/23	medium
151259	EulerOS Virtualization 3.0.6.6 : binutils (EulerOS-SA-2021-2045)	Nessus	Huawei Local Security Checks	2021/7/1	2025/11/20	medium
151768	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2021-2212)	Nessus	Huawei Local Security Checks	2021/7/16	2021/7/21	medium
152668	FreeBSD : binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section() (f4c54b81-bcc8-11eb-a7a6-080027f515ea)	Nessus	FreeBSD Local Security Checks	2021/8/19	2021/8/23	medium
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	2024/7/23	2025/8/20	critical
151158	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2021-2024)	Nessus	Huawei Local Security Checks	2021/6/30	2021/7/2	medium
151306	EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2021-2122)	Nessus	Huawei Local Security Checks	2021/7/2	2021/7/6	medium
151220	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2047)	Nessus	Huawei Local Security Checks	2021/7/1	2021/7/6	medium
151241	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2058)	Nessus	Huawei Local Security Checks	2021/7/1	2021/7/6	medium
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/20	critical
149287	Photon OS 4.0: Binutils PHSA-2021-4.0-0017	Nessus	PhotonOS Local Security Checks	2021/5/5	2025/8/22	medium
150249	EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2021-1974)	Nessus	Huawei Local Security Checks	2021/6/4	2021/6/8	medium
150278	EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2021-1964)	Nessus	Huawei Local Security Checks	2021/6/4	2021/6/8	medium
151031	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2021-1976)	Nessus	Huawei Local Security Checks	2021/6/28	2021/6/30	medium

检测

插件搜索

medium

medium

medium

medium

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium