Executive brief
A memory leak vulnerability was identified in GNU Binutils, a collection of binary tools used by developers to manipulate and analyze program files. Specifically, the 'objdump' utility, which is used to display information about object files, fails to properly release memory during certain operations. While this could theoretically lead to increased resource consumption, it is considered a minor issue as the leak occurs only once during the program's execution and requires local access to exploit.
Technical details
A memory leak (CWE-401) exists in GNU Binutils versions 2.43 and 2.44 within the objdump utility. The vulnerability is located in the display_info function in binutils/bucomm.c, where the program fails to free the 'arg.info' structure after its effective lifetime. An attacker with local access could trigger this leak by executing objdump with specific flags (e.g., -i or -Zi). The leak is limited to a single allocation per execution, significantly reducing the potential for a Denial of Service (DoS) attack. A patch has been committed to the master branch (commit ba6ad3a18cb26b79e0e3b84c39f707535bbc344d) to address the issue.
Affected products
- GNU Binutils 2.43, 2.44
Timeline
- 2025-02-18: disclosed: Bug reported to Sourceware Bugzilla (PR32716)
- 2025-02-18: patched: Patch committed to GNU Binutils master branch
- 2025-04-04: advisory: CVE-2025-3198 published
References
- https://sourceware.org/bugzilla/show_bug.cgi?id=32716
- https://sourceware.org/bugzilla/show_bug.cgi?id=32716
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d
- https://vuldb.com/?ctiid.303151
- https://vuldb.com/?id.303151
- https://vuldb.com/?submit.545773
- https://www.gnu.org/