CVE-2021-3826: 
NixOS vulnerability analysis and mitigation

A heap/stack buffer overflow vulnerability was discovered in the dlang_lname function within d-demangle.c in libiberty. The vulnerability, identified as CVE-2021-3826, was discovered in September 2021 and affects the symbol demangling functionality. The vulnerable function was introduced in gcc-11.1.0 on May 14, 2020, and was later patched in gcc-12.1.0 on September 23, 2021 (Ubuntu CVE).

The vulnerability exists in the dlang_lname function of d-demangle.c, which is part of the libiberty library. The issue occurs when processing crafted mangled symbols, where a null pointer dereference could occur due to improper input validation. The vulnerability has been assigned a CVSS 3 Severity Score of 6.5 (Medium) (Ubuntu CVE).

When successfully exploited, this vulnerability can lead to a denial of service condition through a segmentation fault and subsequent crash of the affected application. The impact occurs when processing specially crafted mangled symbols (NVD).

The vulnerability was patched in gcc-12.1.0 with commit 54810401974 titled 'libiberty: prevent buffer overflow when decoding user input'. Various distributions have backported the fix to their maintained versions, including Fedora and Ubuntu. Users are advised to update to the patched versions of the affected packages (GCC Patch).