CoreCVE
Back

MEDIUM

binutils: Stack Exhaustion in the demangling functions provided by libiberty

Published Jun 22, 2018

Description

An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new.

Affected products

Remediation

Red Hat statement

The issue is classified as low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting its exploitation potential. The stack overflow in demangle_class_name() only triggers during the parsing of malformed ELF files, which would require an attacker to convince a user to process a malicious file with binutils. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security.

Metrics

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (11)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 22, 2018
Updated Aug 5, 2024
Reserved Jun 22, 2018
Link CVE-2018-12641
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-12641
Red Hat
Severity Low
Public date Apr 13, 2018
Links CVE-2018-12641 - Bugzilla