GNU Binutils up to 2.39 dwarf2.c find_abstract_instance memory leak

Summaryinfo

A vulnerability, which was classified as problematic, has been found in GNU Binutils up to 2.39. This affects the function find_abstract_instance of the file dwarf2.c. This manipulation causes memory leak. The identification of this vulnerability is CVE-2022-48065. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in GNU Binutils up to 2.39 (Programming Tool Software). It has been declared as problematic. Affected by this vulnerability is the function find_abstract_instance of the file dwarf2.c. The manipulation with an unknown input leads to a memory leak vulnerability. The CWE definition for the vulnerability is CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. As an impact it is known to affect availability. The summary by CVE is:

GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.

The weakness was shared 08/23/2023. It is possible to read the advisory at sourceware.org. This vulnerability is known as CVE-2022-48065 since 12/29/2022. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 234114 (CBL Mariner 2.0 Security Update: gdb (CVE-2022-48065)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.40 eliminates this vulnerability. Applying the patch d28fbc7197ba0e021a43f873eff90b05dcdcff6a is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (234114). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Tool Software

Vendor

• GNU

Name

• Binutils

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37
• 2.38
• 2.39

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion