CVE-2025-3198

What it actually does

Local memory leak in objdump display_info function allows repeated invocation to exhaust available memory without releasing allocated buffers.

Why it matters to the business

Systems running affected objdump versions may experience degraded performance or crashes during binary inspection tasks, increasing operational overhead for debugging and build pipelines; urgency remains low given local-only access and absence from known exploitation lists.

How an attack unfolds

An attacker with local access crafts or obtains a binary file that triggers the display_info leak when processed by objdump, repeatedly invoking the utility to accumulate unreleased memory until the process or system becomes unresponsive.

How to fix it

Upgrade affected packages to the fixed versions listed (0:4.18.0-147.34.1.el8_1 for all listed kernel and bpftool packages on Red Hat Enterprise Linux 8.1 EUS). Rebuild or reinstall any custom Binutils installations from source containing commit ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. Remove or restrict local execution of objdump where possible until patched.

How to confirm the fix worked

Confirm package versions match the fixed releases, then execute objdump against known triggering inputs while monitoring memory usage with tools such as valgrind or /proc monitoring to verify no leaks occur.

Typical attack path

1. Obtain local shell or execution context on target system
2. Prepare or locate input binary that exercises the vulnerable display_info path
3. Invoke objdump repeatedly against the input to trigger incremental memory allocation without release
4. Monitor system memory until resource exhaustion occurs

How to detect it

Review local process execution logs and system memory metrics for repeated objdump invocations coinciding with unexplained memory growth; no remote indicators exist.

What your security team should do

• Prioritize patching all listed Red Hat packages to 0:4.18.0-147.34.1.el8_1 within standard maintenance windows
• Inventory systems using objdump in automated pipelines and schedule updates
• Apply least-privilege controls to limit which users can execute objdump
• Monitor EPSS and KEV status for future changes indicating increased risk