Stack Consumption Vulnerability in GNU Binutils and libiberty Packages
Summary
UBUNTU-CVE-2019-9071: An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Binutils is a collection of binary tools essential for managing binary files, including object files, archives, and executable files. It provides functionalities such as linking, assembling, and disassembling. The libiberty library, part of GNU Binutils, offers utility functions for various programming tasks. The vulnerability identified as CVE-2019-9071 affects these packages, allowing for potential stack consumption issues during recursive calls, which can lead to denial of service.
Vulnerability Detail
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in the function d_count_templates_scopes located in cp-demangle.c. This vulnerability can be exploited through crafted input that triggers excessive recursive calls, leading to stack overflow and potential denial of service. The vulnerability is classified with a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider limiting the input size to the affected functions or disabling features that utilize the vulnerable library until an update can be applied.
Conclusion
The CVE-2019-9071 vulnerability in GNU Binutils and libiberty poses a risk of stack consumption leading to denial of service. Users are encouraged to update their packages to the latest versions to mitigate this risk. For those unable to update immediately, workarounds are available to help manage the vulnerability until a fix can be applied.
See every vulnerability recorded for binutils →
FAQ
CVE-2019-9071 is a vulnerability in GNU libiberty that can lead to stack consumption and potential denial of service due to excessive recursive calls.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability can lead to denial of service, causing applications that rely on the affected packages to crash or become unresponsive.
Yes, patched versions of the affected packages are available. Users should update to the latest versions to mitigate the risk.
If you cannot update immediately, consider implementing input size limitations or disabling features that utilize the vulnerable library until a patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
