CVE-2021-46195

Published: 14 January 2022

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

Notes

gcc-3.3 only provides libstdc++5
gcc-msp430 is based on gcc-4.6.3
gcc-m68hc1x is based on gcc-3.3.6
gcc-h8300-hms is based on gcc-3.4.6

gcc-i686-linux-android and gcc-arm-linux-androideabi are based on gcc-4.7

affected function introduced in gcc-11

This is the same CVE as CVE-2021-3530, but applied to GCC

libiberty and binutils tracked as CVE-2021-3530

affected function, demangler_path, introduced on 2020-11-13 in 11.1.0 with 84096498a7b ("libiberty: Support the new ("v0") mangling scheme in rust-demangle")

GCC fix on 2022-01-31 in 12.1.0 with f10bec5ffa4 ("libiberty: Fix infinite recursion in rust demangler.")

Status

Severity score breakdown

References

• https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=f10bec5ffa487ad3033ed5f38cfd0fc7d696deab
• https://www.cve.org/CVERecord?id=CVE-2021-46195
• NVD
• Launchpad
• Debian

Bugs

• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841 (dupe bug)
• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98886