GNU Binutils up to 2.39 ELF File dwarf2.c load_separate_debug_files memory allocation

Summaryinfo

A vulnerability classified as problematic has been found in GNU Binutils up to 2.39. This affects the function load_separate_debug_files of the file dwarf2.c of the component ELF File Handler. Performing a manipulation results in memory allocation. This vulnerability was named CVE-2022-48063. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in GNU Binutils up to 2.39 (Programming Tool Software). This affects the function load_separate_debug_files of the file dwarf2.c of the component ELF File Handler. The manipulation with an unknown input leads to a memory allocation vulnerability. CWE is classifying the issue as CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. This is going to have an impact on availability. The summary by CVE is:

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

The weakness was presented 08/23/2023. It is possible to read the advisory at sourceware.org. This vulnerability is uniquely identified as CVE-2022-48063 since 12/29/2022. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 212944 (CBL Mariner 2.0 Security Update: binutils (CVE-2022-48063)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.40 eliminates this vulnerability. Applying the patch 75393a2d54bcc40053e5262a3de9d70c5ebfbbfd is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (212944). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Tool Software

Vendor

• GNU

Name

• Binutils

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion