PT-2023-6126 · Gnu+7 · Gnu Binutils+7

邓朋 · Published 2023-08-22 · Updated 2025-01-28 · CVE-2022-48063

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GNU Binutils versions prior to 2.40

Description The issue is related to excessive memory consumption via the load separate debug files function at dwarf2.c. An attacker could supply a crafted ELF file, potentially leading to a DNS attack. The vulnerability can be exploited by a remote attacker who provides a specially crafted ELF file.

Recommendations For GNU Binutils versions prior to 2.40, update to version 2.40 or later to resolve the issue. As a temporary workaround, consider restricting the use of the load separate debug files function in dwarf2.c to minimize the risk of exploitation. Avoid processing untrusted ELF files until the issue is resolved.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2024-9331

AZL-28051

BDU:2023-06832

CVE-2022-48063

OPENSUSE-SU-2023_3825-1

OPENSUSE-SU-2024:13411-1

ROSA-SA-2025-2645

SUSE-SU-2023:3695-1

SUSE-SU-2023:3825-1

USN-6413-1

USN-6655-1

Affected Products

Alt Linux

Astra Linux

Debian

Gnu Binutils

Linuxmint

Red Os

Suse

Ubuntu

References · 86

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=29924 · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6413-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6655-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48063 · Security Note
• https://ubuntu.com/security/notices/USN-6655-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-28051 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6543 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-35205 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48063 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20671 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47007 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48063 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3695-1 · Vendor Advisory