CVE-2018-20657: High severity GNU binutils vulnerability
A memory leak was found in the demangletemplate function in GNU libiberty, as distributed in GNU Binutils. A crafted filed could cause the application to crash.
Upstream issue:
https://gcc.gnu.org/bugzilla/showbug.cgi?id=88539
Other sources
The demangletemplate function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20657?
CVE-2018-20657 is considered to have moderate severity due to its potential to allow applications to crash.
How do I fix CVE-2018-20657?
To mitigate CVE-2018-20657, ensure you update to the patched version of GNU Binutils or the affected F5 Traffix Systems Signaling Delivery Controller.
What causes the memory leak in CVE-2018-20657?
The memory leak in CVE-2018-20657 is caused by the demangle_template function in GNU libiberty when processing crafted files.
Which versions of GNU Binutils are affected by CVE-2018-20657?
GNU Binutils version 2.31.1 is specifically noted as affected by CVE-2018-20657.
Can CVE-2018-20657 be exploited remotely?
CVE-2018-20657 requires a crafted file to trigger the memory leak, generally limiting the risk of remote exploitation.