CVE-2020-21490 — Missing Release of Memory after Effective Lifetime in Binutils

CWE-401 — Missing Release of Memory after Effective Lifetime8 documents7 sources

Severity

5.5MEDIUMNVD

EPSS

0.0%

top 93.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

GNU Binutils

Timeline

PublishedAug 22

Latest updateSep 18

Description

An issue was discovered in GNU Binutils 2.34. It is a memory leak when process microblaze-dis.c. This one will consume memory on each insn disassembled.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDgnu/binutils< 2.34

▶Debiangnu/binutils< 2.33.50.20200107-1+3

▶Ubuntugnu/binutils< 2.24-5ubuntu14.2+esm3+2

🔴Vulnerability Details

OSV

binutils vulnerabilities↗2023-09-18

▶

GHSA

GHSA-qgjh-xmjv-7xqp: An issue was discovered in GNU Binutils 2↗2023-08-22

▶

OSV

CVE-2020-21490: An issue was discovered in GNU Binutils 2↗2023-08-22

▶

CVEList

CVE-2020-21490: An issue was discovered in GNU Binutils 2↗2023-08-22

▶

📋Vendor Advisories

Ubuntu

GNU binutils vulnerabilities↗2023-09-18

▶

Debian

CVE-2020-21490: binutils - An issue was discovered in GNU Binutils 2.34. It is a memory leak when process m...↗2020

▶

Red Hat

binutils: memory leak in get_field() in microblaze-dis.c↗2019-12-04

▶