Invia #933333: GNU GNU Binutils binutils 2.47 NULL Pointer Dereference

# Vulnerability: NULL Pointer Dereference in `_bfd_elf_eh_frame_section_offset` of GNU Binutils ld During Relocatable Linking of Malformed .eh_frame

**Project:** GNU Binutils / GNU ld (https://sourceware.org/git/?p=binutils-gdb.git)
**Version:** Present in binutils 2.47 (release tarball version date `20260726`) and dev snapshot `2.47.50.20260722` (commit `640a79623`); no upstream fix as of this writing (2026-08-16)
**Date:** 2026-07-28
**Severity:** Medium
**OWASP:** N/A — native binary parsing memory safety
**CWE:** CWE-476 - NULL Pointer Dereference

------

## Affected Files

```text
bfd/elf-eh-frame.c (`_bfd_elf_eh_frame_section_offset`)
bfd/elf.c (`_bfd_elf_section_offset` call path)
bfd/elflink.c (`elf_link_input_bfd`, `_bfd_elf_final_link`)
ld/ldwrite.c (`ldwrite`, trigger path via ld -r)
```

## Root Cause

During a relocatable link (`ld -r`), the final link stage queries section offsets for `.eh_frame`-related relocations via `elf_link_input_bfd()` → `_bfd_elf_section_offset()` → `_bfd_elf_eh_frame_section_offset()`. A malformed `.eh_frame` section leaves the CIE/FDE parsing state inconsistent with the subsequent query, and `cie_inf` (or an equivalent state) is dereferenced while still NULL. `_bfd_elf_eh_frame_section_offset()` reads an address near NULL (`0xa`) at `bfd/elf-eh-frame.c:1840`, crashing the `ld` process — a DoS-grade NULL pointer dereference.

This defect resides in the section-offset query path of the eh_frame handler and differs from bug 34445 (a crash in the write path); the reporter believes it may be an incomplete fix of bug 33478 and bug 33499. As of this writing, no upstream fix commit is available.

## Steps to Reproduce

The following commands assume this report's `pocs` directory sits next to the built `binutils-gdb` directory:

```bash
git clone https://sourceware.org/git/binutils-gdb.git binutils-gdb
cd binutils-gdb
git checkout 640a79623
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu MAKEINFO=true
make -j
```

The binutils 2.47 release tarball (version date `20260726`) also reproduces. Run the PoC:

```bash
export ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
./ld/ld-new -r -o /dev/null ../pocs/34446/bug_9.o
```

Expected result on the vulnerable version:

```text
==65106==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a
The signal is caused by a READ memory access.
#0 _bfd_elf_eh_frame_section_offset bfd/elf-eh-frame.c:1840
#1 _bfd_elf_section_offset bfd/elf.c:13361
#2 elf_link_input_bfd bfd/elflink.c:11987
#3 _bfd_elf_final_link bfd/elflink.c:13189
#4 ldwrite ld/ldwrite.c:548
SUMMARY: AddressSanitizer: SEGV in _bfd_elf_eh_frame_section_offset
```


## Impact

A crafted object file can crash `ld` during a relocatable link, causing denial of service. Any toolchain, build system, or CI pipeline that exposes GNU ld to untrusted input files (e.g., services performing partial links on user-uploaded object files) can be terminated by this malformed `.eh_frame` input.

## Recommended Fix

In `_bfd_elf_eh_frame_section_offset()` and related eh_frame query paths, thoroughly validate the parsed CIE/FDE state: when the state is NULL or inconsistent with the input, return a link error instead of continuing to dereference; and add the malformed `.eh_frame` sample to AddressSanitizer regression coverage. No upstream fix exists as of this writing; until a fix is released, avoid running `ld -r` directly on untrusted object files, or upgrade promptly after the upstream fix lands.

------

## References

- Bugzilla issue 34446: https://sourceware.org/bugzilla/show_bug.cgi?id=34446
- PoC attachment (bug_9): https://sourceware.org/bugzilla/attachment.cgi?id=16874
- Related earlier bug 33478: https://sourceware.org/bugzilla/show_bug.cgi?id=33478
- Related earlier bug 33499: https://sourceware.org/bugzilla/show_bug.cgi?id=33499
- Related write-path bug 34445: https://sourceware.org/bugzilla/show_bug.cgi?id=34445
- Affected versions: binutils 2.47 (version date 20260726) / dev snapshot commit 640a79623
- Binutils repository: https://sourceware.org/git/?p=binutils-gdb.git
- Reproduction materials (PoC): https://github.com/Ech06/CVE_submit/tree/main/bugzilla/pocs/34446

## Notes

As of 2026-08-16, the issue remains UNCONFIRMED on Bugzilla with no fix commit. The reporter notes it may be an incomplete fix of bug 33478 and bug 33499; it lives on a different code path from bug 34445 (eh_frame write-path crash) — this issue is on the section-offset query path.

• Fonte: ⚠️ https://github.com/Ech06/CVE_submit/blob/main/bugzilla/issues/34446.md
• Utente: Ech06 (UID 98792)
• Sottomissione: 16/08/2026 13:02 (30 giorni fa)
• Moderazione: 15/09/2026 04:01 (30 days later)
• Stato: Accettato
• Voce VulDB: 404050 [GNU Binutils 2.47 Eh Frame bfd/elf-eh-frame.c _bfd_elf_eh_frame_section_offset negazione del servizio]
• Punti: 20