Memory Leak Vulnerability in GNU Binutils Package
Summary
ALPINE-CVE-2025-3198: A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affects binutils versions < 2.43.1-r3. Fixed in 2.43.1-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Binutils is a collection of binary tools that are essential for managing binary files, including object files, archives, and executable files. It provides functionalities such as linking, assembling, and disassembling, making it a critical component in software development and deployment. The package is widely used in various Linux distributions, including Alpine Linux. However, it has been found to have a vulnerability that can lead to memory leaks, which can affect system performance and stability.
Vulnerability Detail
A vulnerability has been identified in GNU Binutils versions 2.43 and 2.44, specifically in the function display_info located in the file binutils/bucomm.c of the objdump component. This vulnerability allows for a memory leak, which can be exploited locally by an attacker. The implications of this vulnerability include potential degradation of system performance and stability due to excessive memory usage. The vulnerability has been publicly disclosed, and a patch has been made available to address the issue.
How To Fix
Minimum fixed version
2.43.1-r3
This is the first release that contains the fix.
sudo apk add --upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
In summary, the memory leak vulnerability in GNU Binutils poses a risk to system performance and stability. It is crucial to update to the patched versions provided for Alpine Linux to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for binutils →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The memory leak can lead to increased memory consumption, potentially causing system slowdowns or crashes if not addressed.
No, this vulnerability requires local access to exploit, making it less critical than remote vulnerabilities.
If you cannot update the package immediately, monitor your system for unusual behavior and plan to apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
