CVE-2022-47010

An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

• SECURITY UPDATE: memory leak in stab_demangle_v3_arg
  • debian/patches/CVE-2022-47007.patch: free dt on failure path
  • CVE-2022-47007
• SECURITY UPDATE: memory leak in make_tempdir
  • debian/patches/CVE-2022-47008.patch: free template on all failure paths
  • CVE-2022-47008
• SECURITY UPDATE: memory leak in pr_function_type
  • debian/patches/CVE-2022-47010.patch: free "s" on failure path
  • CVE-2022-47010
• SECURITY UPDATE: memory leak in parse_stab_struct_fields
  • debian/patches/CVE-2022-47011.patch: free "fields" on failure path
  • CVE-2022-47011

• SECURITY UPDATE: reachable assertion failure in display_debug_names
  • debian/patches/CVE-2022-35205.patch: replace assert with a warning message
  • CVE-2022-35205
• SECURITY UPDATE: memory leak in stab_demangle_v3_arg
  • debian/patches/CVE-2022-47007.patch: free dt on failure path
  • CVE-2022-47007
• SECURITY UPDATE: memory leak in make_tempdir
  • debian/patches/CVE-2022-47008.patch: free template on all failure paths
  • CVE-2022-47008
• SECURITY UPDATE: memory leak in pr_function_type
  • debian/patches/CVE-2022-47010.patch: free "s" on failure path
  • CVE-2022-47010
• SECURITY UPDATE: memory leak in parse_stab_struct_fields
  • debian/patches/CVE-2022-47011.patch: free "fields" on failure path
  • CVE-2022-47011

• CVE-2022-47007: fix memory leak in stab_demangle_v3_arg
• CVE-2022-47008: fix memory leak in make_tempdir and make_tempname
• CVE-2022-47011: fix memory leak in parse_stab_struct_fields
• CVE-2022-47010: fix memory leak in pr_function_type
• CVE-2022-48063: fix excessive memory allocation in load_specific_debug_section for corrupt ELF
• CVE-2022-48064: fix SHT_NOBITS section size sanity check in find_debug_info
• CVE-2022-48065: fix memory leak in find_abstract_instance on duplicate DW_AT_decl_file
• CVE-2022-38533: fix rewrite_elf_program_header looping on crafted file (strip/objcopy)

• CVE-2022-38533: fix heap buffer overflow in bfd_getl32 from strip_main with crafted COFF file
• CVE-2022-47007: fix memory leak in stab_demangle_v3_arg in stabs.c
• CVE-2022-47008: fix memory leak in make_tempdir and make_tempname in bucomm.c
• CVE-2022-47010: fix memory leak in pr_function_type in prdbg.c
• CVE-2022-48064: fix excessive memory consumption in bfd_dwarf2_find_nearest_line_with_alt
• CVE-2023-1972: fix heap buffer overflow in _bfd_elf_slurp_version_tables

An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.

It was discovered that GNU binutils was not properly performing checks when dealing with memory allocation operations, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2017-17122, CVE-2017-8421)

It was discovered that GNU binutils was not properly performing bounds checks when processing debug sections with objdump, which could lead to an overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2018-20671, CVE-2018-6543)

It was discovered that GNU binutils contained a reachable assertion, which could lead to an intentional assertion failure when processing certain crafted DWARF files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-35205)

It was discovered that GNU binutils incorrectly handled memory management operations in several of its functions, which could lead to excessive memory consumption due to memory leaks. An attacker could possibly use these issues to cause a denial of service. (CVE-2022-47007, CVE-2022-47008, CVE-2022-47010, CVE-2022-47011)

It was discovered that GNU binutils was not properly performing bounds checks when dealing with memory allocation operations, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-48063)

It was discovered that GNU binutils was not properly performing bounds checks in several functions, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service, expose sensitive information or execute arbitrary code. (CVE-2022-44840, CVE-2022-45703)

It was discovered that GNU binutils incorrectly handled memory management operations in several of its functions, which could lead to excessive memory consumption due to memory leaks. An attacker could possibly use these issues to cause a denial of service. (CVE-2022-47007, CVE-2022-47008, CVE-2022-47010, CVE-2022-47011)