Stack Exhaustion Vulnerability in GNU Binutils and Libiberty
Summary
UBUNTU-CVE-2018-9138: An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Binutils is a collection of binary tools essential for managing binary files, including object files, archives, and executable files. It provides functionalities such as linking, assembling, and disassembling. The libiberty library, included in Binutils, offers utilities for demangling C++ symbols. This vulnerability affects versions 2.29 and 2.30, where recursive stack frames in demangling functions can lead to stack exhaustion, potentially causing application crashes.
Vulnerability Detail
An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. The vulnerability arises from stack exhaustion in the C++ demangling functions, specifically in the recursive functions demangle_nested_args, demangle_args, do_arg, and do_type. This can lead to a denial of service, as the application may crash due to excessive stack usage. The CVSS score for this vulnerability is 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the input to the demangling functions to prevent excessive recursion. However, this is not a permanent solution and updating the packages is recommended.
Conclusion
The stack exhaustion vulnerability in GNU Binutils and libiberty poses a risk of application crashes due to excessive stack usage in demangling functions. It is crucial to update to the patched versions of the affected packages to mitigate this risk.
See every vulnerability recorded for binutils →
FAQ
The vulnerability can lead to stack exhaustion, causing applications that utilize the affected functions to crash.
Versions 2.29 and 2.30 of GNU Binutils are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider limiting the input to the demangling functions as a temporary workaround.
The CVSS score for this vulnerability is 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
