GDB gdbserver heap memory disclosure and denial of service
A Linux program-checking tool can let remote attackers peek at memory and crash it.
Summary
A length validation flaw in gdbserver's agent-expression parser lets an unauthenticated remote attacker read uninitialized heap memory and cause a denial of service. The leaked memory includes addresses useful for defeating ASLR.
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Times
First published
First seen