| عنوان | GNU Binutils 2.47 (version date 20260726) Heap-based Buffer Overflow |
|---|
| الوصف | A vulnerability was found in GNU Binutils 2.47 and classified as problematic.
Affected is the `ld` (GNU linker) component. The manipulation of a malformed
ELF relocatable object file processed with `ld --gc-sections --no-print-gc-sections -w`
leads to a heap-based buffer overflow (out-of-bounds READ). It is possible to
launch the attack locally. No authentication is required. User interaction is
required (the victim must link the malicious object file).
Technical Details
- Affected file/function: bfd/cache.c:436 (cache_bwrite)
- Vulnerable parameter: section-contents buffer / fwrite nbytes
- Attack vector: Local (linking a malicious .o file)
- Privileges required: None (any user able to invoke ld)
- Trigger condition: Linking a malformed ELF object with `--gc-sections -w`
- Allocation site: bfd_get_full_section_contents -> bfd_malloc
(bfd/compress.c:763) allocates a 22-byte region; cache_bwrite calls
fwrite(from, 1, nbytes, f) with nbytes larger than the buffer.
- ASAN: READ of size 32 at 0x503000000c86, located 0 bytes after a 22-byte
region [0x503000000c70, 0x503000000c86). PID 54489.
- Reproduction: Build binutils 2.47 with
CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common'
LDFLAGS='-fsanitize=address' and the configure flags
--disable-gdb --disable-gdbserver --disable-sim --disable-cet
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu.
Then run:
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1" \
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_3.o
Call stack:
#0 __interceptor_fwrite
#1 cache_bwrite bfd/cache.c:436
#2 bfd_write bfd/bfdio.c:417
#3 _bfd_generic_set_section_contents bfd/libbfd.c:1348
#4 _bfd_elf_set_section_contents bfd/elf.c:10072
#5 bfd_set_section_contents bfd/section.c:1509
#6 elf_link_input_bfd bfd/elflink.c:12284
#7 _bfd_elf_final_link bfd/elflink.c:13189
#8 ldwrite ld/ldwrite.c:548
This is the same crash site as bug 33457, previously only confirmed against
binutils 2.45. The issue still reproduces at HEAD/2.47 — the prior fix
appears incomplete; `--gc-sections -w` now reaches the same OOB read.
Impact
- Confidentiality: Low (heap OOB read may leak adjacent heap memory)
- Integrity: None (read-only)
- Availability: Low (process abort under ASAN; benign without sanitizer)
CVSS v3.1
Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Timeline
- Discovered: 2026-08-09
- Vendor notified: 2026-08-09 (public bugzilla entry)
- Patch released: [pending upstream 2.48]
- Public disclosure: 2026-08-09
Countermeasure
Track upstream binutils 2.48 release. The fix should validate that `nbytes`
does not exceed the buffer's actual allocation length in `cache_bwrite`, and
reconcile the allocation size in `bfd_get_full_section_contents` with the
write length. As a workaround, do not pass `--gc-sections -w` against
untrusted `.o`/`.a` files; audit object-file provenance in CI/CD; run
linking inside a sandboxed/containerized environment. |
|---|
| المصدر | ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Heap-buffer-overflow%20in%20%60cache_bwrite%60%20(bfdcache.c436)%20via%20malformed%20ELF%20with%20%60--gc-sections%20-w%60.md |
|---|
| المستخدم | Dem0000000 (UID 98743) |
|---|
| ارسال | 10/08/2026 12:49 PM (1 شهر منذ) |
|---|
| الاعتدال | 13/09/2026 05:33 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 403303 [GNU Binutils 2.47 ld bfd/cache.c cache_bwrite nbytes تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|