CVE-2018-6872

The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.

The prerequisites for successful exploitation of this bug involves both independent filesystem access as well as the victim to interact with the file created.

• An attacker needs to create a file (such as an ELF file) containing a note section with a large alignment value designed to trigger the out-of-bounds read in the elf_parse_notes function.
• The attacker must convince a user to process the malicious file using a tool that utilizes the vulnerable libbfd library, such as objdump or readelf.

Considering the high bar of prerequites for successful exploitation, RH ProdSec has set the Impact of this vulnerability to "Low"

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.