CVE Request: multiple bugs found in BFD libraries and Binutils' utilities

[Thuan Pham <thuanpv () comp nus edu sg>]

Dear all,

Using AFLGo, a directed version of AFL/AFLFast fuzzing tool, we found
several bugs in the Binutils' utilities such as readelf, objdump, nm and
the BFD library (DWARF and STABS parsers).

Binary File Descriptor (BFD) library is a GNU library to manipulate object
files of many processor architecture (>=25) in a variety of formats (>=50).
The library is used by several widely-used tools like GNU Assembler (GAS),
GNU Linker (GLD), GNU Binary Utilities ("binutils") tools, and the GNU
Debugger (GDB). Binutils' utilities like readelf, objdump and nm are common
tools to analyze program objects..

Here is the list of bug reports & bug fixes. All of them have been
confirmed and fixed by Binutils' maintainers.

1) Heap Buffer Overflow - Invalid Write in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21137
https://sourceware.org/bugzilla/show_bug.cgi?id=21155 (bug still exists
because of incomplete fix in PR Binutils/21137)

2) Heap Buffer Overflow - Invalid Read in BFD library's DWARF
https://sourceware.org/bugzilla/show_bug.cgi?id=21151

3) Heap Buffer Overflow - Invalid Read in BFD library's handling of STABS
debug information causing Objdump to crash
https://sourceware.org/bugzilla/show_bug.cgi?id=21157

4) Global Buffer Overflow - Invalid Read in BFD library's handling of STABS
debug information
https://sourceware.org/bugzilla/show_bug.cgi?id=21158

5) Use after free in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21139

6) Heap buffer overflow - invalid read of size 4 in Readelf
https://sourceware.org/bugzilla/show_bug.cgi?id=21156

7) Heap buffer overflow in Readelf (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21135
https://sourceware.org/bugzilla/show_bug.cgi?id=21159 (bug still exists due
to incomplete fix in PR Binutils/21135)

8) Heap buffer overflow in Readelf (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21147

9) Heap buffer overflow in Readelf (Multiple Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21148

10) Heap buffer overflow in Readelf (Multiple Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21149

11) Global buffer overflow in Nm (Invalid Read of size 1)
https://sourceware.org/bugzilla/show_bug.cgi?id=21150

Could you please check whether these bugs are suitable for CVEs?
Many thanks,

----------------------------
Thuan Pham
TSUNAMi Security Research Center
National University of Singapore