SUSE-SU-2024:0319-1: Security update for gdb
This update for gdb fixes the following issues: Drop libdebuginfod1 BuildRequires/Recommends. The former isn't needed because there's a build requirement on libdebuginfod-devel already, which will pull the shared library. And the latter, because it's bogus since RPM auto generated dependency will take care of that requirement. gdb was released in 13.2: This version of GDB includes the following changes and enhancements:
Support for the following new targets has been added in both GDB and GDBserver: GNU/Linux/LoongArch (gdbserver) loongarch--linux GNU/Linux/CSKY (gdbserver) csky-linux
The Windows native target now supports target async.
Floating-point support has now been added on LoongArch GNU/Linux.
New commands: set print nibbles [on|off] show print nibbles
This controls whether the 'print/t' command will display binary values in groups of four bits, known as "nibbles". The default is 'off'. Various styling-related commands. See the gdb/NEWS file for more details. Various maintenance commands. These are normally aimed at GDB experts or developers. See the gdb/NEWS file for more details.
Python API improvements: New Python API for instruction disassembly.
The new attribute 'locations' of gdb.Breakpoint returns a list of gdb.BreakpointLocation objects specifying the locations where the breakpoint is inserted into the debuggee. New Python type gdb.BreakpointLocation. New function gdb.formataddress(ADDRESS, PROGSPACE, ARCHITECTURE) that formats ADDRESS as 'address ' New function gdb.currentlanguage that returns the name of the current language. Unlike gdb.parameter('language'), this will never return 'auto'. New function gdb.printoptions that returns a dictionary of the prevailing print options, in the form accepted by gdb.Value.formatstring. New method gdb.Frame.language that returns the name of the frame's language. gdb.Value.formatstring now uses the format provided by 'print', if it is called during a 'print' or other similar operation. gdb.Value.formatstring now accepts the 'summary' keyword. This can be used to request a shorter representation of a value, the way that 'set print frame-arguments scalars' does. The gdb.registerwindowtype method now restricts the set of acceptable window names. The first character of a window's name must start with a character in the set [a-zA-Z], every subsequent character of a window's name must be in the set [-.a-zA-Z0-9].
GDB/MI changes:
MI version 1 is deprecated, and will be removed in GDB 14. The async record stating the stopped reason 'breakpoint-hit' now contains an optional field locno.
Miscellaneous improvements: gdb now supports zstd compressed debug sections (ELFCOMPRESSZSTD) for ELF. New convenience variable $inferiorthreadcount contains the number of live threads in the current inferior. New convenience variables $hitbpnum and $hitlocno, set to the breakpoint number and the breakpoint location number of the breakpoint last hit. The "info breakpoints" now displays enabled breakpoint locations of disabled breakpoints as in the "y-" state. The format of 'disassemble /r' and 'record instruction-history /r' has changed to match the layout of GNU objdump when disassembling.
A new format "/b" has been introduce to provide the old behavior of "/r". The TUI no longer styles the source and assembly code highlighted by the current position indicator by default. You can however re-enable styling using the new "set style tui-current-position" command. It is now possible to use the "document" command to document user-defined commands. Support for memory tag data for AArch64 MTE.
Support Removal notices: DBX mode has been removed. Support for building against Python version 2 has been removed. It is now only possible to build GDB against Python 3. Support for the following commands has been removed:
set debug aix-solib on|off show debug aix-solib set debug solib-frv on|off show debug solib-frv
Use the "set/show debug solib" commands instead. See the NEWS file for a more complete and detailed list of what this release includes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/gdb-debugsourceto a version that resolves this vulnerability.Fixed in 13.2-2.23.1 - Upgrade
Upgrade
suse/gdbserver-debuginfoto a version that resolves this vulnerability.Fixed in 13.2-2.23.1 - Upgrade
Upgrade
suse/gdbserverto a version that resolves this vulnerability.Fixed in 13.2-2.23.1 - Upgrade
Upgrade
suse/gdb-debuginfoto a version that resolves this vulnerability.Fixed in 13.2-2.23.1 - Upgrade
Upgrade
suse/gdb-debuginfoto a version that resolves this vulnerability.Fixed in 32bit-13.2-2.23.1 - Upgrade
Upgrade
suse/gdbserverto a version that resolves this vulnerability.Fixed in 32bit-13.2-2.23.1 - Upgrade
Upgrade
suse/gdbserver-debuginfoto a version that resolves this vulnerability.Fixed in 32bit-13.2-2.23.1 - Upgrade
Upgrade
suse/gdbto a version that resolves this vulnerability.Fixed in 13.2-2.23.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SDK-12-SP5-2024-319=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-2024-319=1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployed components are covered by this update?
The update covers gdb, gdbserver, and their debuginfo and debugsource packages. The listed affected products are SUSE Linux Enterprise Software Development Kit 12 SP5 and SUSE Linux Enterprise High Performance Computing 12 SP5 on the specified aarch64, ppc64le, s390x, and x86_64 architectures.
Does the available advisory data identify an exploit path, CVE, or temporary mitigation?
No. The provided data does not name a CVE, describe attacker prerequisites or affected default configurations, or provide a workaround for systems that cannot yet install the update.