CVE-2022-48064

2023-08-2219:16:30

Google

osv.dev

cve-2022-48064

gnu binutils

excessive memory consumption

vulnerability

function bfd_dwarf2_find_nearest_line_with_alt

dwarf2.c

crafted elf file

dns attack

software

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.

CPENameOperatorVersion
binutils-gdb.giteqgdb_5_3-branchpoint
binutilseq2.40.50.20230611-2
binutils-gdb.giteqgdb-10-branchpoint
binutilseq2.39.50.20221010-1
binutilseq2.38.50.20220629-3
binutilseq2.40.90.20230729-2
binutilseq2.37.50.20220106-2
binutilseq2.39.50.20221208-5
binutils-gdb.giteqgdb_7_3-branchpoint
binutilseq2.37-6

Name	Operator	Version
binutils-gdb.git	eq	gdb_5_3-branchpoint
binutils	eq	2.40.50.20230611-2
binutils-gdb.git	eq	gdb-10-branchpoint
binutils	eq	2.39.50.20221010-1
binutils	eq	2.38.50.20220629-3
binutils	eq	2.40.90.20230729-2
binutils	eq	2.37.50.20220106-2
binutils	eq	2.39.50.20221208-5
binutils-gdb.git	eq	gdb_7_3-branchpoint
binutils	eq	2.37-6