PT-2025-6070 · Gnu+2 · Gnu Binutils+2

孙文举 · Published 2025-02-10 · Updated 2025-12-12 · CVE-2025-1150

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GNU Binutils version 2.43

Description A memory leak vulnerability has been found in GNU Binutils, affecting the bfd malloc function of the libbfd.c file in the ld component. The manipulation of this vulnerability can lead to a memory leak. The attack can be initiated remotely, and the complexity of the attack is rather high. The exploitation appears to be difficult. The code maintainer has stated that the reported leaks have been fixed in the binutils master branch.

Recommendations For GNU Binutils version 2.43, apply a patch to fix this issue. As a temporary workaround, consider restricting the use of the bfd malloc function in the libbfd.c file until a patch is available.

Exploit

Fix

Improper Resource Release

Memory Leak

Weakness Enumeration

CWE-404

CWE-401

Related Identifiers

AZL-56693

AZL-56719

AZL-56773

AZL-56780

CVE-2025-1150

ECHO-09F7-E6DB-15D0

OPENSUSE-SU-2025:15651-1

OPENSUSE-SU-2025:20150-1

SUSE-SU-2025:21195-1

SUSE-SU-2025:21197-1

SUSE-SU-2025:4096-1

Affected Products

Debian

Gnu Binutils

Suse

References · 88

• 🔥 https://sourceware.org/bugzilla/attachment.cgi?id=15887 · Exploit
• https://osv.dev/vulnerability/AZL-56719 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15651-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4096-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1150 · Security Note
• https://osv.dev/vulnerability/AZL-56780 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-1150 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-1150 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1150 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-56693 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1150 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21197-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-1150 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-1150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1150 · Security Note