CVE-2025-1147

What it actually does

The flaw allows a remote attacker to trigger a buffer overflow in the __sanitizer::internal_strlen function within binutils/nm.c by supplying a crafted argument value.

Why it matters to the business

Organizations relying on the affected GitLab instances face potential service disruption or unauthorized access attempts if the component is invoked with malicious input, though exploitation difficulty limits immediate widespread risk.

How an attack unfolds

An attacker crafts a malicious input string for the nm utility's argument handling path, sends it remotely to trigger the strlen buffer overflow, and leverages the resulting memory corruption for further actions; public disclosure increases the chance of attempted use by motivated actors despite high complexity.

How to fix it

Upgrade affected GitLab instances to one of the fixed commits: 9ec4d64efe3c4c92cc03112b5b3e150829196b06 or 23b707e976d91b0e43abb14493c7782e8ff79187.

How to confirm the fix worked

Verify the running version contains one of the listed fixed commits and test nm functionality with known problematic argument patterns to confirm absence of overflow behavior.

Typical attack path

1. Identify reachable instances exposing the nm component
2. Craft and transmit a specially formed argument to trigger the overflow
3. Exploit resulting memory corruption for code execution or denial of service
4. Establish persistence or exfiltrate data if successful

How to detect it

Review application and system logs for unusual nm process invocations or argument patterns that could indicate attempted exploitation; correlate with any memory error or crash reports.

What your security team should do

• Apply the specified commit upgrades immediately across all instances
• Monitor for any public exploit code updates given the disclosure status
• Review and restrict exposure of nm-related functionality where feasible