CVE-2022-48064 Denial of service in n/a
Attackers can cause excessive memory consumption and denial of service in GNU Binutils by supplying a crafted ELF file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-48064?
CVE-2022-48064 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 22 Aug 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
Weakness: CWE-770
Which versions are affected by CVE-2022-48064?
It affects 3 products.
Linux distribution packages (17)
gdb SUSE:Enterprise Storage 7.1 | All versions | 14.2-150100.8.45.1 |
gdb SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 14.2-150100.8.45.1 |
gdb SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 14.2-150100.8.45.1 |
gdb SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 14.2-150400.15.20.1 |
gdb SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 14.2-150400.15.20.1 |
gdb SUSE:Linux Enterprise Module for Development Tools 15 SP5 | All versions | 14.2-150400.15.20.1 |
gdb SUSE:Linux Enterprise Module for Development Tools 15 SP6 | All versions | 14.2-150400.15.20.1 |
gdb SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 14.2-150100.8.45.1 |
gdb SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 14.2-150100.8.45.1 |
gdb SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 14.2-150400.15.20.1 |
gdb SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 14.2-150100.8.45.1 |
gdb SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 14.2-150100.8.45.1 |
gdb SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 14.2-150400.15.20.1 |
gdb openSUSE:Leap 15.5 | All versions | 14.2-150400.15.20.1 |
gdb-testresults openSUSE:Leap 15.5 | All versions | 14.2-150400.15.20.1 |
gdb openSUSE:Leap 15.6 | All versions | 14.2-150400.15.20.1 |
gdb-testresults openSUSE:Leap 15.6 | All versions | 14.2-150400.15.20.1 |
Products include Fedoraproject Fedora, Gnu Binutils, Netapp Ontap Select Deploy Administration Utility.
How do I fix CVE-2022-48064?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-48064 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48064 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-28589, BELL-CVE-2022-48064, DEBIAN-CVE-2022-48064, GHSA-p564-948g-fpq9, OESA-2023-1595, OESA-2023-1596 and 6 more.