-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe primary source of information is the commit patch and the detailed explanation from the Bushido Security advisory. The commit e0323071916878e0634a6e24d8250e4faff67e88 directly modifies the first_phase function in bfd/tekhex.c. The commit message explicitly states that the change is to guard against modification of _bfd_std_section[] entries, which aligns with the vulnerability description of an out-of-bounds read near this global variable. The Bushido Security advisory confirms that the root cause is in first_phase due to improper handling of bfd_abs_section_ptr, leading to an attempt to modify its properties. The patch adds checks (bfd_is_const_section) to prevent these modifications. Therefore, first_phase is identified as the vulnerable function as it contained the logic that, prior to the patch, allowed for the conditions leading to the buffer overflow.
Ongoing coverage of React2Shell