Ubuntu.comUB:CVE-2022-35206CVE-2022-35206
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1.9 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:N/A:P
0.0004 Low
EPSS
Percentile
12.0%
Null pointer dereference vulnerability in Binutils readelf 2.38.50 via
function read_and_display_attr_value in file dwarf.c.
Notes
| Author | Note |
|---|---|
| seth-arnold | binutils isn’t safe for untrusted inputs. |
| ccdm94 | according to the patch referenced in the issue, the dereference happens when the ‘debug_info_p’ variable is referenced but not set in a ‘fetch_indexed_string’ call, in ‘read_and_display_attr_value’. In bionic and earlier, these specific calls (referenced in the patch) are not made sending ‘debug_info_p’ as an argument. |
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
1.9 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:N/A:P
0.0004 Low
EPSS
Percentile
12.0%