Enviar #920281: GNU Binutils 2.47 (version date 20260726) Heap-based Buffer Overflow

A vulnerability was found in GNU Binutils 2.47 and classified as critical.
Affected is the `ld` (GNU linker) component. The manipulation of a malformed
ELF relocatable object file with a malformed `.eh_frame` section leads to a
heap-based buffer overflow (out-of-bounds READ), a negative-size `memmove`
call (size = -1, equivalent to an enormous write), and an invalid-pointer
SEGV. It is possible to launch the attack locally. No authentication is
required. User interaction is required (the victim must link the malicious
object file).

Technical Details
- Affected file/function: bfd/elf-eh-frame.c:2064 / :2083 / :2193
(_bfd_elf_write_section_eh_frame)
- Vulnerable parameter: CIE/FDE lengths, augmentation-data sizes, write
offsets
- Attack vector: Local (linking a malicious .o file)
- Privileges required: None (any user able to invoke ld)
- Trigger conditions (three sub-PoCs share one root cause):
* bug_14: `ld --shared -z relro -o /dev/null bug_14.o`
triggers heap-buffer-overflow READ at elf-eh-frame.c:2083
* bug_20: `ld --version-exports-section symbol --shared -o /dev/null bug_20.o`
triggers negative-size-param (memmove size = -1) at elf-eh-frame.c:2064
* bug_8: `ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_8.o`
triggers SEGV (READ) at elf-eh-frame.c:2193
- Root cause: _bfd_elf_write_section_eh_frame parses CIE/FDE entries from
the input `.eh_frame` section during final link and writes back the
transformed contents. Lengths, augmentation-data sizes, and write offsets
derived from a malformed CIE/FDE entry are not validated:
* :2083 — read at contents + offset, offset past buffer end;
* :2064 — memmove invoked with size = -1 (unsigned underflow to
0xFFFFFFFFFFFFFFFF);
* :2193 — write through an unchecked pointer (0x28), SEGV.
- ASAN:
* bug_14 — READ of size 1 at 0x529000013200, located 0 bytes after a
16384-byte region. (A large number — tens of thousands — of BFD
assertion failures at elf-eh-frame.c:2138 precede the ASAN report.)
PID 54610.
* bug_20 — negative-size-param: (size=-1), caller elf-eh-frame.c:2064.
PID 54611.
* bug_8 — SEGV on unknown address 0x000000000028 (READ memory access,
address points to the zero page). PID 54612.
- Reproduction: Build binutils 2.47 with
CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common'
LDFLAGS='-fsanitize=address' and the configure flags
--disable-gdb --disable-gdbserver --disable-sim --disable-cet
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu.
Then run any of the three trigger commands above with
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1".

Call stack (bug_20):
#0 __interceptor_memmove
#1 memmove /usr/include/x86_64-linux-gnu/bits/string_fortified.h:36
#2 _bfd_elf_write_section_eh_frame bfd/elf-eh-frame.c:2064
#3 elf_link_input_bfd bfd/elflink.c:12218
#4 _bfd_elf_final_link bfd/elflink.c:13189

This may be an incomplete fix for bug 32642.

Impact
- Confidentiality: Low (heap OOB read via bug_14)
- Integrity: High (negative-size memmove via bug_20 — large-scale heap
corruption, potentially exploitable for code execution)
- Availability: High (process crash via bug_8)

CVSS v3.1
Score: 7.3 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H

Timeline
- Discovered: 2026-08-09
- Vendor notified: 2026-08-09 (public bugzilla entry)
- Patch released: [pending upstream 2.48]
- Public disclosure: 2026-08-09

Countermeasure
Track upstream binutils 2.48 release. The fix should validate all CIE/FDE
lengths, augmentation-data lengths, and write offsets in
_bfd_elf_write_section_eh_frame, and explicitly check that `size` is
non-negative before calling memmove. As a workaround, do not pass
`--shared -z relro`, `--version-exports-section`, or `--gc-sections -w`
against untrusted `.o`/`.a` files; audit object-file provenance in CI/CD;
run linking inside a sandboxed/containerized environment.

• Fuente: ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Heap%20OOB%20write%20%20negative-size%20%60memmove%60%20%20SEGV%20in%20%60_bfd_elf_write_section_eh_frame%60%20(bfdelf-eh-frame.c2064%20%202083%20%202193)%20via%20malformed%20%60.eh_frame%60.md
• Usuario: Dem0000000 (UID 98743)
• Sumisión: 2026-08-10 13:02 (hace 1 mes)
• Moderación: 2026-09-13 17:34 (1 month later)
• Estado: Aceptado
• Entrada de VulDB: 403306 [GNU Binutils 2.47 Eh Frame Section bfd/elf-eh-frame.c _bfd_elf_write_section_eh_frame desbordamiento de búfer]
• Puntos: 20