CVE-2021-3826

2022-09-0100:00:00

ubuntu.com

cve-2021-3826

dlang_lname function

denial of service

libiberty

segmentation fault

gcc-11.1.0

gcc-12.1.0

buffer overflow

symbol demangling

abi spec

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

70.5%

JSON

Heap/stack buffer overflow in the dlang_lname function in d-demangle.c in
libiberty allows attackers to potentially cause a denial of service
(segmentation fault and crash) via a crafted mangled symbol.

Notes

Author	Note
sbeattie	gcc-3.3 only provides libstdc++5 gcc-msp430 is based on gcc-4.6.3 gcc-m68hc1x is based on gcc-3.3.6 gcc-h8300-hms is based on gcc-3.4.6 gcc-i686-linux-android and gcc-arm-linux-androideabi are based on gcc-4.7
eslerm	vulnerable function added in gcc-11.1.0 on 2020-05-14 with 3f30a274913 (“libiberty: Update D symbol demangling for latest ABI spec.”) patched for gcc-12.1.0 on 2021-09-23 with 54810401974 (“libiberty: prevent buffer overflow when decoding user input”)

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchgcc-11< anyUNKNOWN
ubuntu24.04noarchgcc-11< anyUNKNOWN
ubuntu18.04noarchgdb< anyUNKNOWN
ubuntu16.04noarchgdb< anyUNKNOWN
ubuntu22.04noarchlibiberty< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	gcc-11	< any	UNKNOWN
ubuntu	24.04	noarch	gcc-11	< any	UNKNOWN
ubuntu	18.04	noarch	gdb	< any	UNKNOWN
ubuntu	16.04	noarch	gdb	< any	UNKNOWN
ubuntu	22.04	noarch	libiberty	< any	UNKNOWN