GNU Binutils up to 2.39 ELF File dwarf2.c bfd_dwarf2_find_nearest_line_with_alt memory allocation

Summaryinfo

A vulnerability classified as problematic was found in GNU Binutils up to 2.39. This impacts the function bfd_dwarf2_find_nearest_line_with_alt of the file dwarf2.c of the component ELF File Handler. Executing a manipulation can lead to memory allocation. The identification of this vulnerability is CVE-2022-48064. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in GNU Binutils up to 2.39 (Programming Tool Software). This vulnerability affects the function bfd_dwarf2_find_nearest_line_with_alt of the file dwarf2.c of the component ELF File Handler. The manipulation with an unknown input leads to a memory allocation vulnerability. The CWE definition for the vulnerability is CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. As an impact it is known to affect availability. CVE summarizes:

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

The weakness was shared 08/23/2023. The advisory is shared for download at sourceware.org. This vulnerability was named CVE-2022-48064 since 12/29/2022. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 234115 (CBL Mariner 2.0 Security Update: gdb (CVE-2022-48064)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.40 eliminates this vulnerability. Applying the patch 8f2c64de86bc3d7556121fe296dd679000283931 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (234115). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Tool Software

Vendor

• GNU

Name

• Binutils

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion