PT-2018-3925 · Gnu+3 · Gnu Binutils+3
Published
2018-04-11
·
Updated
2021-07-21
·
CVE-2018-12698
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
GNU Binutils version 2.30
Description
The issue is related to the demangle template function in the cplus-dem.c component of GNU Binutils, which is associated with uncontrolled resource consumption. This allows a remote attacker to cause a denial of service. The vulnerability can be triggered during the execution of objdump, leading to excessive memory consumption, also known as an out-of-memory (OOM) condition, when creating an array for saving template argument values during the XNEWVEC call.
Recommendations
For GNU Binutils version 2.30, consider disabling the demangle template function in cplus-dem.c as a temporary workaround to minimize the risk of exploitation. Restrict access to the objdump execution to reduce the likelihood of triggering the excessive memory consumption.
Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Gnu Binutils
Ubuntu