Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-38533: GNU Binutils heap buffer overflow in error function

CVE-2022-38533 · published 4 years ago

Summary

GNU Binutils, a tool for working with object files, has a bug that can cause a memory overflow when processing certain types of files. This could potentially allow an attacker to execute malicious code. To mitigate this risk, update to a version of GNU Binutils that is not affected by this issue.

What to do

Update debian binutils to version 2.39.50.20221208-2.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	gnu	binutils	<= 2.39 `cpe:2.3:a:gnu:binutils::::::::`
–	fedoraproject	fedora	36 37 `cpe:2.3:o:fedoraproject:fedora:36:::::::*`
Debian:12	debian	binutils	< 2.39.50.20221208-2 Fix: upgrade to 2.39.50.20221208-2

Original advisory text

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38533... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-38533 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2022-38533 Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://security.netapp.com/advisory/ntap-20221104-0007/ Vendor Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=29482 Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=29482#c2 Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=29495 Third Party Advisory
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=45d92439aebd0386ef8... URL
https://github.com/bminor/binutils-gdb/commit/45d92439aebd0386ef8af76e1796d08cfe... Patch
https://security.gentoo.org/glsa/202309-15 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published25 Aug 2022

Updated4 Nov 2026

First seen30 Jul 2026

Sources

CVE-2022-38533 · OSV

CVE-2022-38533 · NVD

DEBIAN-CVE-2022-38533 · OSV

CVE-2022-38533 · MITRE

Track software like this

Free during beta