CVE-2025-69647: Medium severity GNU binutils vulnerability
GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.41-11
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69647?
CVE-2025-69647 is classified as a denial-of-service vulnerability due to its ability to cause readelf to repeatedly print the same output without progressing.
How do I fix CVE-2025-69647?
To fix CVE-2025-69647, update GNU Binutils to a version newer than 2.45.1 where this vulnerability has been addressed.
What are the potential impacts of CVE-2025-69647?
The potential impacts of CVE-2025-69647 include system resource exhaustion and denial of service when processing specially crafted binaries.
Which versions of GNU Binutils are affected by CVE-2025-69647?
GNU Binutils versions up to and including 2.45.1 are affected by CVE-2025-69647.
Does CVE-2025-69647 affect all platforms running GNU Binutils?
Yes, CVE-2025-69647 affects all platforms running vulnerable versions of GNU Binutils.