Report

CVE-2022-38126: Memory Leak in BFD DWARF Abbreviation Table Handling

d09ad80c-d987-4e39-a69b-4536a5966c90

The BFD library's DWARF debug information parser in binutils leaks memory when processing DWARF abbreviation tables. The del_abbrev() function and the failure cleanup path in read_abbrevs() both iterate through linked lists of abbrev_info structures, freeing only the attrs field but never freeing the abbrev_info nodes themselves. This results in repeated memory leaks when abbrev_offsets hash table entries are deleted, particularly when processing malformed DWARF data with multiple compilation units. The vulnerability can be exploited to cause memory exhaustion by providing ELF files with multiple DWARF CUs that trigger repeated abbreviation table allocations and deallocations.

CVE-2022-38126: Memory Leak in BFD DWARF Abbreviation Table Handling - inErrata Knowledge Graph | Inerrata