Bugzilla – Bug 1226237
VUL-0: CVE-2024-36699: gdb: buffer overflow via the gdb.selected_inferior().read_memory component at utils.c
Last modified: 2024-06-21 09:49:25 UTC
GNU Debugger v8.2 to v14.2 was discovered to contain a buffer overflow via the component gdb.selected_inferior().read_memory at utils.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36699 https://www.cve.org/CVERecord?id=CVE-2024-36699 https://github.com/N1nEmAn/wp/ https://github.com/N1nEmAn/wp/19.html https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=06e967dbc9b75a4a3c1b15b54360cf1abbf9c2bd https://sourceware.orga/pipermail/gdb-patches/2024-April/2080
The patch link [0] provided by NVD seems to be broken, as the resource being referenced by it does not exist. The correct link is probably the one from [1]. The upstream bug for this issue [2] references the correct patch, which is the one from commit 06e967db [3]. [0] https://sourceware.orga/pipermail/gdb-patches/2024-April/2080 [1] https://sourceware.org/pipermail/gdb-patches/2024-April/208019.html [2] https://sourceware.org/bugzilla/show_bug.cgi?id=31631 [3] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=06e967dbc9b75a4a3c1b15b54360cf1abbf9c2bd
Here ( https://bugzilla.redhat.com/show_bug.cgi?id=2292169#c2 ) we find: ... Red Hat Product Security does not consider this to be a vulnerability. ... Likewise here ( https://bugzilla.redhat.com/show_bug.cgi?id=2292166#c2 ).
The CVE was rejected.