Bug 2544475
| Summary: | CVE-2026-13732 gdb: gdb: Out-of-bounds write in STABS parser read_member_functions() via crafted ELF [fedora-all] | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Tomas Hoger <thoger> | ||||
| Component: | gdb | Assignee: | Kevin Buettner <kevinb> | ||||
| Status: | NEW --- | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | rawhide | CC: | ahajkova, artem, fweimer, guinevere, jan, keiths, kevinb, mcermak, mkolar, suraj.ghimire7 | ||||
| Target Milestone: | --- | Keywords: | Security, SecurityTracking | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | {"flaws": ["97f8de55-a63b-4679-98c1-4a0f8a751ea9"]} | ||||||
| Fixed In Version: | Doc Type: | --- | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | Type: | --- | |||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 2494416 | ||||||
| Attachments: |
|
||||||
Created attachment 2161889 [details]
upstream patch
Hello, Thank you for maintaining GDB in Fedora. I've attached a backport of the upstream fix for CVE-2026-13732 for Fedora 43 and 44, and would appreciate your review. CVE-2026-13732 is an out-of-bounds write in GDB's STABS reader. When read_member_functions() splits destructors out of a C++ method group, it updates the wrong list link. Destructor entries stay in the main list even though the list length has already been reduced, so copying the list into its array writes past the end. A crafted ELF with .stab/.stabstr sections triggers it as soon as the user does symbol lookups (for example, setting a breakpoint); the program does not need to run. The CVE report says this was turned into arbitrary command execution inside GDB. Fedora 43, 44, 45 and Rawhide all ship GDB 17.2, which has the bug. Upstream fixed it on gdb-17-branch in commit 496e05a32afe498db1f1cc76cde5defce9cbd185, which is not in a release yet. (GDB 18 no longer has the STABS reader.) The patch is that upstream change, unmodified: it moves the "last_sublist = tmp_sublist" update so the predecessor pointer advances when a member is kept rather than when one is removed. Nothing else changes. AI assistance was used to prepare this patch and its validation. The resulting changes and validation results were reviewed by a human. Please let me know if anything needs adjusting for Fedora. |
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. A flaw was found in the GDB STABS debug format parser. The read_member_functions() function in gdb/stabsread.c processes C++ member function lists from STABS symbol data. When a class contains both destructor and non-destructor member functions, the code at lines 5086-5131 attempts to separate them into two lists. However, the linked list removal logic has a bug: the `last_sublist` tracking variable is updated to point to REMOVED destructor nodes instead of the previous retained node, and the `continue` path for non-destructor nodes does not update `last_sublist` at all. This causes destructor entries to remain in the `sublist` linked list while the `length` variable is decremented by `has_destructor`. In the subsequent copy loop (lines 5163-5166), the allocated array has `length` elements but the loop iterates over all remaining `sublist` entries (more than `length`). The loop index `i` starts at `length` and decrements, going negative, causing writes before the allocated obstack array. The written data consists of `struct fn_field` members controlled by the attacker through crafted STABS strings. The obstack underflow can corrupt chunk metadata including function pointers, which are called on subsequent obstack operations, resulting in arbitrary code execution. The vulnerability triggers automatically when GDB expands partial symbol tables — any symbol-inspection command (break, ptype, info functions) on a binary containing crafted .stab/.stabstr sections is sufficient. The inferior process does not need to be executed. Upstream: https://sourceware.org/git/binutils-gdb.git Affected: gdb/stabsread.c (read_member_functions, lines 5086-5166) Confirmed on: GDB 16.3-1, Debian trixie, x86-64, glibc 2.41 Reporter: JD Marsters (Bhut Red)