CVE-2022-4285 : An illegal memory access flaw was found in the binutils package. Parsing an ELF

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.

Published 2023-01-27 18:15:16

Updated 2023-09-30 10:15:10

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-4285

Redhat » Enterprise Linux » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux » Version: 9.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Matching versions
GNU » Binutils
Versions from including (>=) 2.35 and before (<) 2.39-7
cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-4285

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-4285

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2022-4285

CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

Assigned by: secalert@redhat.com (Secondary)

References for CVE-2022-4285

https://sourceware.org/bugzilla/show_bug.cgi?id=29699

29699 – Segmentation fault caused by null pointer dereference in nm-new, _bfd_elf_get_symbol_version_string, elf.c:1969
Exploit;Issue Tracking;Patch;Vendor Advisory
https://security.gentoo.org/glsa/202309-15

GNU Binutils: Multiple Vulnerabilities (GLSA 202309-15) — Gentoo security

CVEs referencing this url
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5c831a3c7f3ca98d6aba1200353311e1a1f84c70

sourceware.org Git - binutils-gdb.git/commit
Mailing List;Patch;Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2150768

2150768 – (CVE-2022-4285) CVE-2022-4285 binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault
Exploit;Issue Tracking;Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-4285

Products affected by CVE-2022-4285

Exploit prediction scoring system (EPSS) score for CVE-2022-4285

CVSS scores for CVE-2022-4285

CWE ids for CVE-2022-4285

References for CVE-2022-4285