제출 #920280: GNU Binutils 2.47 (version date 20260726) Heap-based Buffer Overflow

A vulnerability was found in GNU Binutils 2.47 and classified as critical.
Affected is the `ld` (GNU linker) component. The manipulation of a malformed
ELF relocatable object file processed by `ld` leads to a heap-based buffer
overflow (out-of-bounds READ and WRITE) and an invalid-pointer SEGV. It is
possible to launch the attack locally. No authentication is required. User
interaction is required (the victim must link the malicious object file).

Technical Details
- Affected file/function: bfd/elf64-x86-64.c:4530 and :4835
(elf_x86_64_relocate_section)
- Vulnerable parameter: relocation roff (derived from rela.r_offset)
- Attack vector: Local (linking a malicious .o file)
- Privileges required: None (any user able to invoke ld)
- Trigger conditions (three sub-PoCs share one root cause):
* bug_12: `ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_12.o`
triggers heap-buffer-overflow READ at elf64-x86-64.c:4530
* bug_15: `ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_15.o`
triggers heap-buffer-overflow WRITE at elf64-x86-64.c:4835
* bug_19: `ld --version-exports-section symbol -o /dev/null bug_19.o`
triggers SEGV (WRITE) at elf64-x86-64.c:4835
- Root cause: A malformed relocation whose `roff` underflows drives
out-of-bounds bfd_get_8 / bfd_put_8 accesses at
`contents + roff - 5` (:4530) and `contents + roff - 2` (:4835).
bug_15 and bug_19 are the same line; HBO vs SEGV depends on the exact
`roff` value.
- ASAN:
* bug_12 — READ of size 1 at 0x5290000141ff, located 1 byte before a
16384-byte region. PID 54562.
* bug_15 — WRITE of size 1 at 0x52900001e708, located 5384 bytes after a
16384-byte region. PID 54563.
* bug_19 — SEGV on unknown address 0x529000134202 (WRITE memory access).
PID 54564.
- Reproduction: Build binutils 2.47 with
CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common'
LDFLAGS='-fsanitize=address' and the configure flags
--disable-gdb --disable-gdbserver --disable-sim --disable-cet
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu.
Then run any of the three trigger commands above with
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1".

Call stack (bug_15):
#0 elf_x86_64_relocate_section bfd/elf64-x86-64.c:4835
#1 elf_link_input_bfd bfd/elflink.c:11926
#2 _bfd_elf_final_link bfd/elflink.c:13189
#3 ldwrite ld/ldwrite.c:548

This is the same crash site as bug 33502. Upstream fix is committed as
471130b39c03623ec6d78ece377ff4da3f6bfe7b (PR ld/34444, PR ld/34448) and
will ship in binutils 2.48.

Impact
- Confidentiality: Low (heap OOB read via bug_12)
- Integrity: High (heap OOB write via bug_15/bug_19 — controlled-write
primitive potentially achievable, may escalate to code execution)
- Availability: High (process crash)

CVSS v3.1
Score: 7.3 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H

Timeline
- Discovered: 2026-08-09
- Vendor notified: 2026-08-09 (public bugzilla entry)
- Patch released: 2026-07-30 (commit 471130b39c03623ec6d78ece377ff4da3f6bfe7b
on main, slated for 2.48)
- Public disclosure: 2026-08-09

Countermeasure
Upgrade to binutils 2.48 once released; the upstream fix validates that
non-alloc/non-debugging sections do not contain TLS/GOT/PLT relocations,
and that TLS relocations target thread-local symbols. Patch URL:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=471130b39c03623ec6d78ece377ff4da3f6bfe7b
As a workaround, do not pass `--gc-sections -w` or
`--version-exports-section` against untrusted `.o`/`.a` files; audit
object-file provenance in CI/CD; run linking inside a
sandboxed/containerized environment.

• 원천: ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/Heap%20OOB%20readwrite%20and%20SEGV%20in%20%60elf_x86_64_relocate_section%60%20(bfdelf64-x86-64.c4530%20%204835)%20via%20malformed%20relocation.md
• 사용자: Dem0000000 (UID 98743)
• 제출: 2026. 08. 10. PM 12:59 (1 월 ago)
• 모더레이션: 2026. 09. 13. PM 05:34 (1 month later)
• 상태: 수락
• VulDB 항목: 403305 [GNU Binutils 2.47 ld bfd/elf64-x86-64.c elf_x86_64_relocate_section roff 메모리 손상]
• 포인트들: 20