Stack-based buffer overflow in The GNU Project Debugger (GDB) - CVE-2023-39128

Vulnerability identifier: #VU85875

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-39128

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the ada_decode() function in /gdb/ada-lang.c. A remote attacker can trick the victim to run the debugger on a specially crafted file, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

The GNU Project Debugger (GDB)
Robotic Process Automation for Cloud Pak
Ubuntu
openEuler
Anolis OS
gdb (Ubuntu package)
gdbserver (Ubuntu package)
Ubuntu security updates mailing list (Ubuntu package)
gdb
gdb-debuginfo
gdb-headless
gdb-debugsource
gdb-gdbserver
gdb-help
gdb-doc

Install updates from vendor's website.

gdb (Ubuntu package) - addressed in versions Ubuntu Pro, 9.2-0ubuntu1~20.04.2, 12.1-0ubuntu1~22.04.2
gdbserver (Ubuntu package) - addressed in versions Ubuntu Pro, 9.2-0ubuntu1~20.04.2, 12.1-0ubuntu1~22.04.2
Ubuntu security updates mailing list (Ubuntu package) - update to Security announcements mailing list
gdb - update to 9.2-5
gdb-debuginfo - update to 9.2-5
gdb-headless - update to 9.2-5
gdb-debugsource - update to 9.2-5
gdb-gdbserver - update to 9.2-5
gdb-help - update to 9.2-5
gdb-doc - update to 12.1-3
gdb-headless - update to 12.1-3
gdb-gdbserver - update to 12.1-3
gdb - update to 12.1-3
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.10, 23.0.11

• https://sourceware.org/bugzilla/show_bug.cgi?id=30639

• Denial of service in GNU gdb
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler update for gdb
• Ubuntu update for gdb
• Anolis OS update for gdb