CVE-2022-4285

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-01-27 · updated 2026-06-17
Weakness: CWE-476

Description

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.

Affected products

Fedoraproject Fedora: 37
GNU Binutils: from 2.35 before 2.39-7 — fixed in 2.39-7
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0

How to fix

Upgrade to a fixed version: GNU Binutils 2.39-7. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2150768
https://security.gentoo.org/glsa/202309-15
https://sourceware.org/bugzilla/show_bug.cgi?id=29699
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=5c831a3c7f3ca98d6aba1200353311e1a1f84c70
https://bugzilla.redhat.com/show_bug.cgi?id=2150768
https://security.gentoo.org/glsa/202309-15
https://sourceware.org/bugzilla/show_bug.cgi?id=29699
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=5c831a3c7f3ca98d6aba1200353311e1a1f84c70

Get alerted when CVE-2022-4285 or the next vulnerability affects your stack