CVE-2025-1181

GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruption

State: Published
Severity: 2.3 Low
Published: Feb 11, 2025
Updated: Apr 25, 2025
Reserved: Feb 10, 2025

Description

A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	5.0 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L	VulDB
3.0	5.0 Medium	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L	VulDB
2.0	5.1 Medium	AV:N/AC:H/Au:N/C:P/I:P/A:P	VulDB

Weaknesses

CWE-119 Memory Corruption

Affected Products

Product	Versions
BinutilsGNU	2.43Affected

References

VDB-295084 | GNU Binutils ld elflink.c _bfd_elf_gc_mark_rsec memory corruptionvdb-entrytechnical-description
VDB-295084 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #495402 | GNU ld 2.43 illegal read access with --gc-sections --no-print-gc-sections -wthird-party-advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=32643issue-tracking
https://sourceware.org/bugzilla/attachment.cgi?id=15918exploit
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24patch
https://www.gnu.org/product
https://security.netapp.com/advisory/ntap-20250425-0007/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.