GNU nm up to 2.33 Command binutils/nm.c get_data memory allocation

Summaryinfo

A vulnerability identified as problematic has been detected in GNU nm up to 2.33. Affected is the function get_data of the file binutils/nm.c of the component Command Handler. Performing a manipulation results in memory allocation. This vulnerability is reported as CVE-2020-19724. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in GNU nm up to 2.33. It has been classified as problematic. This affects the function get_data of the file binutils/nm.c of the component Command Handler. The manipulation with an unknown input leads to a memory allocation vulnerability. CWE is classifying the issue as CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. This is going to have an impact on availability. The summary by CVE is:

A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.

The weakness was disclosed 08/23/2023. It is possible to read the advisory at sourceware.org. This vulnerability is uniquely identified as CVE-2020-19724 since 08/13/2020. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.34 eliminates this vulnerability. Applying the patch 805f38bc551de820bcd7b31d3c5731ae27cf853a is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• GNU

Name

• nm

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion