CVE-2020-16592

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

The GNU Binutils are a collection of binary tools. The main ones are: ld - the GNU linker. as - the GNU assembler. addr2line - Converts addresses into filenames and line numbers. ar - A utility for creating, modifying and extracting from archives. c++filt - Filter to demangle encoded C++ symbols. dlltool - Creates files for building and using DLLs. gold - A new, faster, ELF only linker, still in beta test. gprof - Displays profiling information. nlmconv - Converts object code into an NLM. nm - Lists symbols from object files. objcopy - Copies and translates object files. objdump - Displays information from object files. ranlib - Generates an index to the contents of an archive. readelf - Displays information from any ELF format object file. size - Lists the section sizes of an object or archive file. strings - Lists printable strings from files. trip - Discards symbols. windmc - A Windows compatible message compiler. windres - A compiler for Windows resource files.

Security Fix(es):

Load value injection in some Intel(R) Processors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. The list of affected products is provided in intel-sa-00334: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00334.html(CVE-2020-0551)

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.(CVE-2020-16592)

A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd_hash_lookup, as demonstrated in nm-new, that can cause a denial of service via a crafted file.

It was discovered that mingw-binutils and binutils suffered from two vulnerabilities which might lead to DoS.

Null Pointer Dereference in debug_get_real_type could result in DoS (CVE-2020-16598).

Use-after-free in bfd_hash_lookup could result in DoS (CVE-2020-16592).

This update for binutils fixes the following issues:

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

• General:

  • When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
  • Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active.
  • Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically.

• X86/x86_64:

  • Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key Locker instructions.
  • Support non-absolute segment values…

This update for binutils fixes the following issues:

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

• General:

  • When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
  • Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active.
  • Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically.

• X86/x86_64:

  • Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key Locker instructions.
  • Support non-absolute segment values…

These are all security issues fixed in the binutils-2.37-1.3 package on the GA media of openSUSE Tumbleweed.

This update for binutils fixes the following issues:

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for the arm-symbianelf format has been removed.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

General:

• When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
• Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active.
• Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically.

X86/x86_64:

 * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
  …

This update for binutils fixes the following issues:

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

• General:

  • When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
  • Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active.
  • Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically.

• X86/x86_64:

  • Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key Locker instructions.
  • Support non-absolute segment values…

This update for binutils fixes the following issues:

• For compatibility on old code stream that expect 'brcl 0,label' to not be disassembled as 'jgnop label' on s390x. (bsc#1192267) This reverts IBM zSeries HLASM support for now.
• Fixed that ppc64 optflags did not enable LTO (bsc#1188941).
• Fix empty man-pages from broken release tarball
• Fixed a memory corruption with rpath option (bsc#1191473).
• Fixed slow performance of stripping some binaries (bsc#1183909).

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

• General:

  • When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
  • Added a .nop directive to generate a single…

It was discovered that GNU binutils incorrectly handled certain hash lookups. An attacker could use this issue to cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-16592)

It was discovered that GNU binutils incorrectly handled certain corrupt DWARF debug sections. An attacker could possibly use this issue to cause GNU binutils to consume memory, resulting in a denial of service. (CVE-2021-3487)