Submit #920277: GNU Binutils 2.47 (version date 20260726) NULL Pointer Dereference

A vulnerability was found in GNU Binutils 2.47 and classified as problematic.
Affected is the `ld` (GNU linker) component. The manipulation of a malformed
ELF relocatable object file processed with `ld --gc-sections --no-print-gc-sections -w`
leads to a NULL-derived-pointer write (SEGV). It is possible to launch the
attack locally. No authentication is required. User interaction is required
(the victim must link the malicious object file).

Technical Details
- Affected file/function: bfd/libbfd.c:989 (bfd_putl64)
- Vulnerable parameter: output relocation buffer pointer
- Attack vector: Local (linking a malicious .o file)
- Privileges required: None (any user able to invoke ld)
- Trigger condition: Linking a malformed ELF object with `--gc-sections -w`
- Call chain: elf_x86_64_relocate_section (elf64-x86-64.c:4683)
-> bfd_elf64_swap_reloca_out (elfcode.h:467)
-> _bfd_elf_append_rela (elflink.c:15625)
-> bfd_putl64 (libbfd.c:989, addr[7] = ... at address 0x7).
A malformed relocation yields a NULL/underflowed output relocation buffer
pointer that is then written through.
- ASAN: SEGV on unknown address 0x000000000007 (WRITE memory access, address
points to the zero page). PID 54520.
- Reproduction: Build binutils 2.47 with
CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common'
LDFLAGS='-fsanitize=address' and the configure flags
--disable-gdb --disable-gdbserver --disable-sim --disable-cet
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu.
Then run:
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1" \
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_10.o

Call stack:
#0 bfd_putl64 bfd/libbfd.c:989
#1 bfd_elf64_swap_reloca_out bfd/elfcode.h:467
#2 _bfd_elf_append_rela bfd/elflink.c:15625
#3 elf_x86_64_relocate_section bfd/elf64-x86-64.c:4683
#4 elf_link_input_bfd bfd/elflink.c:11926
#5 _bfd_elf_final_link bfd/elflink.c:13189
#6 ldwrite ld/ldwrite.c:548

The linker also emits BFD assertion failures at elf64-x86-64.c:5028 and
elflink.c:15624 immediately before the crash.

This is the same crash site as bug 33456, where the prior fix appears
incomplete — the issue still reproduces at HEAD/2.47.

Impact
- Confidentiality: None
- Integrity: Low (potential controlled write depending on the underflowed
pointer value)
- Availability: High (process crash / denial of service)

CVSS v3.1
Score: 5.3 (Medium)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Timeline
- Discovered: 2026-08-09
- Vendor notified: 2026-08-09 (public bugzilla entry)
- Patch released: [pending upstream 2.48]
- Public disclosure: 2026-08-09

Countermeasure
Track upstream binutils 2.48 release. The fix should validate the output
relocation buffer pointer and remaining writable size before calling
_bfd_elf_append_rela and bfd_putl64. As a workaround, do not pass
`--gc-sections -w` against untrusted `.o`/`.a` files; audit object-file
provenance in CI/CD; run linking inside a sandboxed/containerized
environment.

• Source: ⚠️ https://github.com/r1ck9-2q/cve_summit/blob/main/SEGV%20in%20%60bfd_putl64%60%20(bfdlibbfd.c989)%20during%20relocation%20output%20via%20malformed%20ELF.md
• User: Dem0000000 (UID 98743)
• Submission: 08/10/2026 12:55 (1 month ago)
• Moderation: 09/13/2026 17:33 (1 month later)
• Status: Accepted
• VulDB entry: 403304 [GNU Binutils 2.47 ld bfd/libbfd.c bfd_putl64 null pointer dereference]
• Points: 20