CVE-2025-1149

What it actually does

Memory leak triggered via crafted input to the xstrdup function in libiberty/xmalloc.c within the ld linker component, causing gradual resource exhaustion without immediate crash or code execution.

Why it matters to the business

Repeated triggering on build or linking systems may lead to increased memory consumption, degraded performance, and potential service disruption in environments relying on GNU Binutils for compilation and linking workflows.

How an attack unfolds

An attacker supplies specially formed input to the ld linker over a network-accessible interface or via command-line processing; the xstrdup allocation path fails to release memory under specific conditions, resulting in a leak that accumulates with multiple invocations, though the high complexity and difficult exploitability limit practical success.

How to fix it

Apply the memory-leak fixes present on the binutils master branch; avoid relying on the 2.44 release line until the fixes are backported, and rebuild affected tools from a patched source tree.

How to confirm the fix worked

Compile a test binary using ld with repeated invocations of the previously leaking input pattern and monitor process memory statistics with tools such as valgrind or massif to confirm absence of growth; review build logs for any residual allocation warnings.

Typical attack path

1. Identify a remotely reachable or scriptable invocation of ld that processes attacker-controlled input.
2. Craft input designed to exercise the xstrdup code path repeatedly.
3. Monitor target memory usage to confirm gradual increase without triggering immediate errors.
4. Sustain the workload over time to amplify resource consumption and impact availability.

How to detect it

Review system and application logs for repeated ld invocations with unusual argument patterns; correlate with memory-usage metrics from process accounting or container runtime telemetry to identify anomalous growth that coincides with linker activity.

What your security team should do

• Prioritize patching ld and rebuilding Binutils from master for all build servers and CI pipelines within the next maintenance window.
• Reduce exposure by restricting untrusted input to ld and enforcing strict input validation or sandboxing around the linker.
• Monitor memory utilization trends on systems that invoke ld and alert on sustained growth outside normal build patterns.