CVE-2024-57360
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The...
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
- Record
CVE-2024-57360- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-53567
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
- Record
EUVD-2024-53567- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cwjw-x748-4mm6
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The...
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
- Record
GHSA-cwjw-x748-4mm6- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-284, CWE-863
- Updated
- 2026-11-02
NVD
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
- Record
CVE-2024-57360- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVBELL-CVE-2024-57360
- Record
BELL-CVE-2024-57360- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-57360
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
- Record
DEBIAN-CVE-2024-57360- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVOESA-2025-1098
binutils security update
Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).
Security Fix(es):
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.(CVE-2024-57360)
A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.(CVE-2025-0840)
- Record
OESA-2025-1098- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1099
binutils security update
Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).
Security Fix(es):
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.(CVE-2024-57360)
A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.(CVE-2025-0840)
- Record
OESA-2025-1099- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1100
binutils security update
Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).
Security Fix(es):
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.(CVE-2024-57360)
A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.(CVE-2025-0840)
- Record
OESA-2025-1100- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1128
binutils security update
Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).
Security Fix(es):
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.(CVE-2024-57360)
A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.(CVE-2025-0840)
- Record
OESA-2025-1128- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-57360
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
- Record
UBUNTU-CVE-2024-57360- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.
- Record
CVE-2024-57360- Updated
- 2026-11-02
OSVMGASA-2025-0084 No score
Updated binutils packages fix security vulnerabilities
nm >=2.43 is affected by: Incorrect Access Control. The type of
exploitation is: local. The component is: nm --without-symbol-version
function. (CVE-2024-57360)
GNU Binutils objdump.c disassemble_bytes stack-based overflow.
(CVE-2025-0840)
- Record
MGASA-2025-0084- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-57360 No score
CVE-2024-57360 in binutils - Patched by Root
Root has patched CVE-2024-57360 in the binutils package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2024-57360- Updated
- 2026-11-02
OSVUSN-7306-1 No score
binutils vulnerabilities
It was discovered that GNU binutils in nm tool is affected by an incorrect access control. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2024-57360)
It was discovered that GNU binutils incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2025-0840)
- Record
USN-7306-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsAlpaquita:stream |
2.43-r0 up to 2.44-r0 | 2.44-r0 |
binutilsBellSoft Hardened Containers:stream |
2.43-r0 up to 2.44-r0 | 2.44-r0 |
binutilsDebian:12 |
All versions, plus listed versions 2.40-22.40.50.20230111-12.40.50.20230215-12.40.50.20230501-12.40.50.20230510-1 Show 45 moreShow less2.40.50.20230602-12.40.50.20230611-12.40.50.20230611-22.40.50.20230622-12.40.50.20230625-12.40.50.20230630-12.40.90.20230705-12.40.90.20230714-12.40.90.20230714-22.40.90.20230720-12.40.90.20230729-12.40.90.20230729-22.41-12.41-22.41-32.41-42.41-52.41-62.41-72.41.50.20230731-12.41.50.20230803-12.41.50.20230905-12.41.50.20231010-12.41.50.20231101-12.41.50.20231125-12.41.50.20231202-12.41.50.20231206-12.41.50.20231214-12.41.50.20231227-12.41.90.20240115-12.41.90.20240122-12.42-12.42-22.42-2+hurd.12.42-32.42-42.42.50.20240614-12.42.50.20240618-12.42.50.20240625-12.42.50.20240710-12.42.90.20240720-12.42.90.20240720-22.43-12.43-22.43.1-1 |
None known |
binutilsDebian:13 |
before 2.43.50.20241221-1 | 2.43.50.20241221-1 |
binutilsDebian:14 |
before 2.43.50.20241221-1 | 2.43.50.20241221-1 |
binutilsMageia:9 From an advisory covering 2 CVEs |
before 2.40-11.1.mga9 | 2.40-11.1.mga9 |
binutilsopenEuler:22.03-LTS-SP3 From an advisory covering 2 CVEs |
before 2.37-28.oe2203sp3 | 2.37-28.oe2203sp3 |
binutilsopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.37-30.oe2203sp4 | 2.37-30.oe2203sp4 |
binutilsopenEuler:24.03-LTS From an advisory covering 2 CVEs |
before 2.41-10.oe2403 | 2.41-10.oe2403 |
binutilsopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.41-14.oe2403sp1 | 2.41-14.oe2403sp1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
binutilsRoot:Debian:12 |
before 2.40-2.root.io.18 | 2.40-2.root.io.182.40-2.root.io.192.40-2.root.io.202.40-2.root.io.212.40-2.root.io.222.40-2.root.io.232.40-2.root.io.242.40-2.aikido.25 |
rootio-binutilsRoot:Debian:12 |
before 2.40-2.root.io.18 | 2.40-2.root.io.182.40-2.root.io.192.40-2.root.io.202.40-2.root.io.212.40-2.root.io.222.40-2.root.io.232.40-2.root.io.242.40-2.aikido.25 |
binutilsUbuntu:22.04:LTS |
before 2.38-4ubuntu2.7, plus listed versions 2.37-7ubuntu12.37-9ubuntu12.37-10ubuntu12.37.50.20220106-2ubuntu12.37.90.20220126-0ubuntu1 Show 11 moreShow less2.37.90.20220130-0ubuntu22.38-1ubuntu12.38-2ubuntu12.38-3ubuntu12.38-4ubuntu22.38-4ubuntu2.12.38-4ubuntu2.22.38-4ubuntu2.32.38-4ubuntu2.42.38-4ubuntu2.52.38-4ubuntu2.6 |
2.38-4ubuntu2.7 |
binutilsUbuntu:24.04:LTS |
before 2.42-4ubuntu2.4, plus listed versions 2.41-5ubuntu12.41-6ubuntu12.41.50.20231206-1ubuntu12.41.50.20231214-1ubuntu12.41.50.20231227-1ubuntu1 Show 6 moreShow less2.41.90.20240122-1ubuntu12.42-2ubuntu12.42-3ubuntu12.42-4ubuntu12.42-4ubuntu22.42-4ubuntu2.3 |
2.42-4ubuntu2.4 |
binutilsUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 2.34-6ubuntu1.10, plus listed versions 2.33-2ubuntu12.33.1-1ubuntu12.33.1-5ubuntu12.33.1-6ubuntu12.33.1-6ubuntu3 Show 14 moreShow less2.33.90.20200122-1ubuntu22.34-1ubuntu12.34-3ubuntu12.34-4ubuntu12.34-5ubuntu12.34-6ubuntu12.34-6ubuntu1.12.34-6ubuntu1.32.34-6ubuntu1.42.34-6ubuntu1.52.34-6ubuntu1.62.34-6ubuntu1.72.34-6ubuntu1.82.34-6ubuntu1.9 |
2.34-6ubuntu1.10 |
binutilsUbuntu:22.04:LTS From an advisory covering 2 CVEs |
before 2.38-4ubuntu2.7, plus listed versions 2.37-7ubuntu12.37-9ubuntu12.37-10ubuntu12.37.50.20220106-2ubuntu12.37.90.20220126-0ubuntu1 Show 11 moreShow less2.37.90.20220130-0ubuntu22.38-1ubuntu12.38-2ubuntu12.38-3ubuntu12.38-4ubuntu22.38-4ubuntu2.12.38-4ubuntu2.22.38-4ubuntu2.32.38-4ubuntu2.42.38-4ubuntu2.52.38-4ubuntu2.6 |
2.38-4ubuntu2.7 |
binutilsUbuntu:24.04:LTS From an advisory covering 2 CVEs |
before 2.42-4ubuntu2.4, plus listed versions 2.41-5ubuntu12.41-6ubuntu12.41.50.20231206-1ubuntu12.41.50.20231214-1ubuntu12.41.50.20231227-1ubuntu1 Show 6 moreShow less2.41.90.20240122-1ubuntu12.42-2ubuntu12.42-3ubuntu12.42-4ubuntu12.42-4ubuntu22.42-4ubuntu2.3 |
2.42-4ubuntu2.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-57360 is a medium vulnerability (CVSS 5.5) in binutils, published January 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in binutils 2.44-r0.
References
sourceware.org/bugzilla/show_bug.cgi?id=32467
nvd.nist.gov/vuln/detail/CVE-2024-57360
github.com/advisories/GHSA-cwjw-x748-4mm6
docs.bell-sw.com/security/cves/CVE-2024-57360
security-tracker.debian.org/tracker/CVE-2024-57360
advisories.mageia.org/MGASA-2025-0084.html
Show 11 moreShow less
bugs.mageia.org/show_bug.cgi?id=34053
ubuntu.com/security/notices/USN-7306-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1098
cve.org/CVERecord?id=CVE-2024-57360
Left out here: 79 versions. The JSON record has them.