Bug 2233949 (CVE-2022-48063) - CVE-2022-48063 binutils: excessive memory consumption in load_separate_debug_files() in dwarf.c
Summary: CVE-2022-48063 binutils: excessive memory consumption in load_separate_debug_...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-48063
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2233950 2233951 2233952 2234089 2234090 2234091 2234092 2234093 2234094 2234095 2234096 2234097 2234098 2234099 2234100 2234101 2234102 2234103
Blocks: 2233947
TreeView+ depends on / blocked
 
Reported: 2023-08-23 19:23 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-02-16 08:51 UTC (History)
29 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-11-09 09:15:32 UTC
Embargoed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2023-08-23 19:23:30 UTC
GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

References:
https://sourceware.org/bugzilla/show_bug.cgi?id=29924
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75393a2d54bcc40053e5262a3de9d70c5ebfbbfd

Comment 1 Guilherme de Almeida Suckevicz 2023-08-23 19:25:43 UTC
Created binutils tracking bugs for this issue:

Affects: fedora-all [bug 2233950]


Created gdb tracking bugs for this issue:

Affects: fedora-all [bug 2233951]


Created mingw-binutils tracking bugs for this issue:

Affects: fedora-all [bug 2233952]

Comment 4 Nick Clifton 2023-08-24 11:44:55 UTC
(In reply to Guilherme de Almeida Suckevicz from comment #0)
> GNU Binutils before 2.40 was discovered to contain an excessive memory
> consumption vulnerability via the function load_separate_debug_files at
> dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS
> attack.

The SECURITY.txt file in the upstream GNU Binutils sources makes it clear that bugs in inspectio tools like objdump and readelf should not be considered to be security issues and hence do not qualify as a CVE.

I also fail to see how this bug could be used a part of a DNS attack, since invoking an inspection tool like objdump is not part of any normal service.


Note You need to log in before you can comment on or make changes to this bug.