CVE-2017-10686 Information

Description

In Netwide Assembler (NASM) 2.14rc0 there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example it causes a corrupted double-linked list in detoken() a double free or corruption in delete_Token() and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.

CVSS Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://bugzilla.nasm.us/show_bug.cgi?id=3392414 https://security.gentoo.org/glsa/201903-19 https://usn.ubuntu.com/3694-1/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8