CVE-2017-9755

Vulnerability

A buffer overflow vulnerability exists in GNU Binutils 2.28, specifically in the opcodes/i386-dis.c file. The flaw occurs because the code does not properly account for the number of registers when handling bnd (bound) mode instructions. This allows a crafted binary file to trigger a buffer overflow when processed by objdump -D [1].

Exploitation

An attacker can exploit this by crafting a malicious binary file that triggers the buffer overflow when a user runs objdump -D on it. The attacker does not require special network position beyond delivering the file (e.g., via email, web download). No authentication is needed beyond the user invoking the command. The overflow occurs during the disassembly step, which is a common operation on binary files [1].

Impact

Successful exploitation results in denial of service via application crash. The CVE description notes that other unspecified impacts may be possible, suggesting potential for code execution depending on the severity of the overflow. The vulnerability has a CVSS v3 score of 7.8 (High), indicating a significant risk [1].

Mitigation

A fix was released in GNU Binutils version 2.29.1-r1. Users should upgrade to this version or later. The Gentoo Security Advisory (GLSA 201801-01) recommends upgrading via emerge --sync && emerge --ask --oneshot --verbose ">=sys-devel/binutils-2.29.1-r1". There are no known workarounds available [1].