Critical Memory Corruption Vulnerability in Binutils Package
Summary
ALPINE-CVE-2025-5244: A vulnerability was found in GNU Binutils up to 2.44. Affects binutils versions < 2.44-r3. Fixed in 2.44-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Binutils package is a collection of binary tools essential for the development and management of software on Unix-like systems. It includes tools for assembling, linking, and manipulating binary files. The package is widely used in various development environments, making it crucial for maintaining software integrity and security. However, a critical vulnerability has been identified that affects versions up to 2.44, posing significant risks to systems utilizing this package.
Vulnerability Detail
A critical vulnerability has been discovered in GNU Binutils, specifically in the function elf_gc_sweep located in bfd/elflink.c. This vulnerability can lead to memory corruption, which may allow an attacker to execute arbitrary code or crash the system. The attack requires local access, making it particularly dangerous in multi-user environments. The exploit has been publicly disclosed, increasing the urgency for affected users to address this issue promptly.
How To Fix
Minimum fixed version
2.44-r3
This is the first release that contains the fix.
sudo apk add --upgrade binutilsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without upgrading the package. Users are advised to restrict local access to systems running vulnerable versions of Binutils until an upgrade can be performed.
Conclusion
The critical memory corruption vulnerability in the Binutils package poses significant risks to systems that utilize it. Users are strongly encouraged to upgrade to version 2.45 or later to mitigate these risks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain software security.
See every vulnerability recorded for binutils →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
No, this vulnerability requires local access to the system to be exploited.
Exploitation of this vulnerability can lead to memory corruption, allowing attackers to execute arbitrary code or crash the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
