CVE-2017-9742

What it actually does

Buffer overflow in score_opcodes within the SCORE7 disassembler when processing a maliciously crafted binary, leading to memory corruption and potential arbitrary code execution or crash during objdump -D or similar operations.

Why it matters to the business

Developers and analysts using affected binutils packages risk tool crashes or full system compromise when examining untrusted binaries; the flaw has been public for years with available exploits, increasing exposure for any downstream build or reverse-engineering pipelines that have not upgraded.

How an attack unfolds

An attacker creates a specially malformed binary file that triggers the vulnerable SCORE7 opcode handler, then social-engineers or automates a victim into running objdump -D or equivalent analysis; the resulting overflow can be leveraged for code execution because the exploit is publicly available.

How to fix it

Upgrade request-1279-1-14 and request-1279-1-14-compat packages to version 1.14.1-r1 or later; rebuild any dependent images or containers and verify the new binutils version is in use before reprocessing untrusted binaries.

How to confirm the fix worked

Confirm package versions match the fixed releases, run objdump -D against known-bad test binaries in an isolated environment, and monitor for crashes or unexpected memory behavior during disassembly.

Typical attack path

1. Craft malicious SCORE7 binary that overflows the opcode buffer
2. Deliver the file to a target environment (email, repo, build artifact)
3. Victim executes objdump -D or automated analysis pipeline on the file
4. Overflow corrupts memory and executes attacker-controlled code or crashes the process

How to detect it

Search process execution logs and command history for objdump invocations against files with unusual sizes or entropy; look for segmentation faults or memory corruption signals in crash reports shortly after binary analysis tasks.

What your security team should do

• Immediately upgrade all listed Chainguard packages to the stated fixed versions
• Scan build pipelines and developer workstations for older binutils instances
• Add untrusted binary analysis to isolated or sandboxed environments only
• Review and update any automated objdump or disassembly jobs to use patched versions