Use After Free in Nasm Netwide Assembler
CVE-2017-10686
In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example, it causes a corrupted double-linked list in detoken(), a double free or corruption in delete_Token(), and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.
Vulnerability class: Use-After-Free
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.029 (86.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.029 · newest: 0.029 · change: 0.000
Affected products
- Nasm Netwide Assembler — versions 2.14
- Canonical Ubuntu Linux — versions 14.04
Weakness classification (CWE)
Public proof-of-concept exploits
References
- usn.ubuntu.com/3694-1/ (vendor-advisory, Third Party Advisory)
- bugzilla.nasm.us/show_bug.cgi (Exploit, Patch, VDB Entry, Third Party Advisory, Issue Tracking)
- security.gentoo.org/glsa/201903-19 (vendor-advisory)
Frequently asked questions
- What is CVE-2017-10686?
- CVE-2017-10686 is a high-severity vulnerability in Nasm Netwide Assembler, classified under Use After Free. CVSS score: 7.8/10. Published 2017-06-29.
- How severe is CVE-2017-10686?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2017-10686 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.