A flaw was found in GDB's STABS debug format parser. The readmemberfunctions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.
A flaw was found in the GDB STABS debug format parser. The readmemberfunctions() function in gdb/stabsread.c processes C++ member function lists from STABS symbol data. When a class contains both destructor and non-destructor member functions, the code at lines 5086-5131 attempts to separate them into two lists. However, the linked list removal logic has a bug: the lastsublist tracking variable is updated to point to REMOVED destructor nodes instead of the previous retained node, and the continue path for non-destructor nodes does not update lastsublist at all. This causes destructor entries to remain in the sublist linked list while the length variable is decremented by hasdestructor. In the subsequent copy loop (lines 5163-5166), the allocated array has length elements but the loop iterates over all remaining sublist entries (more than length). The loop index i starts at length and decrements, going negative, causing writes before the allocated obstack array. The written data consists of struct fnfield members controlled by the attacker through crafted STABS strings. The obstack underflow can corrupt chunk metadata including function pointers, which are called on subsequent obstack operations, resulting in arbitrary code execution. The vulnerability triggers automatically when GDB expands partial symbol tables — any symbol-inspection command (break, ptype, info functions) on a binary containing crafted .stab/.stabstr sections is sufficient. The inferior process does not need to be executed.
Upstream: https://sourceware.org/git/binutils-gdb.git Affected: gdb/stabsread.c (readmemberfunctions, lines 5086-5166) Confirmed on: GDB 16.3-1, Debian trixie, x86-64, glibc 2.41 Reporter: JD Marsters (Bhut Red)
GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function addpeexportedsym() at /gdb/coff-pe-read.c.
GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function adadecode at /gdb/ada-lang.c.
GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function peas16() at /gdb/coff-pe-read.c.
Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF2 (dwarf2read.c) debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DWFORMblock) that contains a large number of operations.
Integer overflow in the Binary File Descriptor (BFD) library for gdb before 6.3, binutils, elfutils, and possibly other packages, allows user-assisted attackers to execute arbitrary code via a crafted object file that specifies a large number of section headers, leading to a heap-based buffer overflow.
gdb before 6.3 searches the current working directory to load the .gdbinit configuration file, which allows local users to execute arbitrary commands as the user running gdb.