Memory Leak Vulnerability in GNU Binutils by GNU
CVE-2025-1151

2.3LOW

Key Information:

Vendor
Gnu
Status
Binutils
Vendor
CVE Published:
10 February 2025

Badges

👾 Exploit Exists

Summary

A vulnerability has been identified in GNU Binutils version 2.43, specifically within the xmemdup function of the xmemdup.c file component of ld. This issue allows for a memory leak that can be exploited remotely, although the complexity of the attack is considered high and challenging. Despite the disclosure of the exploit to the public, it is advisable for users to promptly apply patches as outlined by the code maintainer. The maintainer has indicated that while leak fixes are available in the binutils master branch, similar fixes will not be committed to the 2.44 branch due to concerns about system stability.

Affected Version(s)

Binutils 2.43

References

https://vuldb.com/?id.295055
vdb-entrytechnical-description
https://vuldb.com/?ctiid.295055
signaturepermissions-required
https://sourceware.org/bugzilla/show_bug.cgi?id=32576
issue-tracking

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.