CVE-2025-1153

一、漏洞信息
 漏洞编号：[CVE-2025-1153](https://nvd.nist.gov/vuln/detail/CVE-2025-1153)
 漏洞归属组件：[binutils](https://gitee.com/src-openeuler/binutils)
 漏洞归属的版本：2.34,2.36.1,2.37,2.40,2.41
 CVSS V3.0分值：
  BaseScore：3.1 Low
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
 漏洞简述：
  A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.
 漏洞公开时间：2025-02-11 03:15:39
 漏洞创建时间：2025-02-11 06:31:18
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-1153
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cna.vuldb.com | https://sourceware.org/bugzilla/show_bug.cgi?id=32603 |  |
| cna.vuldb.com | https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150 |  |
| cna.vuldb.com | https://vuldb.com/?ctiid.295057 |  |
| cna.vuldb.com | https://vuldb.com/?id.295057 |  |
| cna.vuldb.com | https://vuldb.com/?submit.489991 |  |
| cna.vuldb.com | https://www.gnu.org/ |  |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.netapp.com/advisory/ntap-20250404-0005/ |  |
| suse_bugzilla | https://www.gnu.org/ | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-1153 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-1153 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://sourceware.org/bugzilla/show_bug.cgi?id=32603 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://vuldb.com/?ctiid.295057 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://vuldb.com/?id.295057 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://vuldb.com/?submit.489991 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2344743 | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |
| suse_bugzilla | https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/1xxx/CVE-2025-1153.json | https://bugzilla.suse.com/show_bug.cgi?id=1237000 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://sourceware.org/bugzilla/show_bug.cgi?id=32603 |  | nvd |
|  |  | https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150 |  | nvd |
|  |  | https://vuldb.com/?ctiid.295057 |  | nvd |
|  |  | https://vuldb.com/?id.295057 |  | nvd |
|  |  | https://vuldb.com/?submit.489991 |  | nvd |
|  |  | https://www.gnu.org/ |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  binutils社区 [SECURITY.txt](https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=binutils/SECURITY.txt;hb=HEAD) 文档说明如下，```    A security bug is one that threatens the security of a system or    network, or might compromise the security of data stored on it.    In the context of GNU Binutils there are two ways in which such    bugs might occur.  In the first, the programs themselves might be    tricked into a direct compromise of security.  In the second, the    tools might introduce a vulnerability in the generated output that    was not already present in the files used as input.    Other than that, all other bugs will be treated as non-security    issues.  This does not mean that they will be ignored, just that    they will not be given the priority that is given to security bugs.    This stance applies to the creation tools in the GNU Binutils (eg    as, ld, gold, objcopy) and the libraries that they use.  Bugs in    inspection tools (eg readelf, nm objdump) will not be considered    to be security bugs, since they do not create executable output    files.```ld为`creation tools`，该CVE涉及内存冲突，ld作为短时运行工具不会长期持续运行，并且不涉及生成源码未包含的恶意代码，该问题将被视为普通bug而不是会威胁系统安全的安全漏洞，分析结论为受影响（bug存在）但不进行修复，如有场景触发bug导致运行报错，再考虑回合修复。
 openEuler评分：
  5.9
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.41):受影响
2.openEuler-20.03-LTS-SP4(2.34):受影响
3.openEuler-22.03-LTS-SP3(2.37):受影响
4.openEuler-22.03-LTS-SP4(2.37):受影响
5.openEuler-24.03-LTS:受影响
6.openEuler-24.03-LTS-Next:受影响
7.openEuler-24.03-LTS-SP1:受影响

修复是否涉及abi变化(是/否)：
  1.master(2.41):否
2.openEuler-20.03-LTS-SP4(2.34):否
3.openEuler-22.03-LTS-SP3(2.37):否
4.openEuler-22.03-LTS-SP4(2.37):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否

原因说明：
  1.master(2.41):不修复-超出修复范围
2.openEuler-20.03-LTS-SP4(2.34):不修复-超出修复范围
3.openEuler-22.03-LTS-SP3(2.37):不修复-超出修复范围
4.openEuler-22.03-LTS-SP4(2.37):不修复-超出修复范围
5.openEuler-24.03-LTS:不修复-超出修复范围
6.openEuler-24.03-LTS-Next:不修复-超出修复范围
7.openEuler-24.03-LTS-SP1:不修复-超出修复范围

src-openEuler/binutils

Content Risk Flag

Comments (7)

src-openEuler/binutils .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-1153

Comments (7)

Search

src-openEuler/binutils