CVE-2017-7614: gnu binutils NULL Pointer Dereference
Vulnerability summary
CVE-2017-7614 is a critical (CVSS 9.8) NULL Pointer Dereference vulnerability in gnu binutils. EPSS estimates a 3.66% chance of exploitation in the next 30 days, higher than 89.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 09-04-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a "member access within null pointer" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an "int main() {return 0;}" program.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.66%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
-0.10 pp
From 3.76% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (blogs.gentoo.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- binutils< 2.28-r1 | < 2.26-r1 | < 2.27-r1
Debian1 product
- binutils< 2.28-4
Gnu1 product
- binutils2.28
Ubuntu1 product
- binutilsAll versions (No fix recorded) | < 2.26.1-1ubuntu1~16.04.8+esm1
4 vendors · 4 products
References
7 links- blogs.gentoo.org/ago/2017/04/05/binutils-two-null-pointer-dereference-in-elflink-c/X Refsource MISCExploitPatchThird Party AdvisoryREPORT
