CVE-2020-19724 — Missing Release of Memory after Effective Lifetime in Binutils

CWE-401 — Missing Release of Memory after Effective Lifetime8 documents7 sources

Severity

5.5MEDIUMNVD

EPSS

0.0%

top 94.79%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

GNU Binutils

Timeline

PublishedAug 22

Latest updateSep 18

Description

A memory consumption issue in get_data function in binutils/nm.c in GNU nm before 2.34 allows attackers to cause a denial of service via crafted command.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDgnu/binutils< 2.34

▶Debiangnu/binutils< 2.33.50.20200114-1+3

▶Ubuntugnu/binutils< 2.24-5ubuntu14.2+esm3+2

🔴Vulnerability Details

OSV

binutils vulnerabilities↗2023-09-18

▶

OSV

CVE-2020-19724: A memory consumption issue in get_data function in binutils/nm↗2023-08-22

▶

GHSA

GHSA-fwgh-55j5-gc7g: A memory consumption issue in get_data function in binutils/nm↗2023-08-22

▶

CVEList

CVE-2020-19724: A memory consumption issue in get_data function in binutils/nm↗2023-08-22

▶

📋Vendor Advisories

Ubuntu

GNU binutils vulnerabilities↗2023-09-18

▶

Red Hat

binutils: memory leak in get_data() in nm.c↗2020-01-10

▶

Debian

CVE-2020-19724: binutils - A memory consumption issue in get_data function in binutils/nm.c in GNU nm befor...↗2020

▶