Submit #933336: GNU GNU Binutils binutils 2.47 NULL Pointer Dereference

# Vulnerability: NULL Pointer Dereference in `elf_x86_64_common_section_index` of GNU Binutils ld During Relocatable Linking of Malformed Common Symbols

**Project:** GNU Binutils / GNU ld (https://sourceware.org/git/?p=binutils-gdb.git)
**Version:** Present in binutils 2.47 (release tarball version date `20260726`) and dev snapshot `2.47.50.20260722` (commit `640a79623`); fixed by commit `7322e9bc30cb282575a701c307851fd3d66fee68`
**Date:** 2026-07-28
**Severity:** Medium
**OWASP:** N/A — native binary parsing memory safety
**CWE:** CWE-476 - NULL Pointer Dereference

------

## Affected Files

```text
bfd/elf64-x86-64.c (`elf_x86_64_common_section_index`)
bfd/elflink.c (`elf_link_output_extsym`, `_bfd_elf_final_link`)
ld/ldwrite.c (`ldwrite`, trigger path via ld -r)
```

## Root Cause

During a relocatable link (`ld -r`), `elf_link_output_extsym()` is called by `_bfd_elf_final_link()` via `bfd_hash_traverse()` and enters `elf_x86_64_common_section_index()` to compute the common section index for an output symbol. That function unconditionally calls `elf_section_flags(sec)` to read the section's ELF flags; when the input object file is not ELF (the PoC is actually a PE/x86-64 COFF object), the section has no initialized ELF-specific data, and the flags read lands on an address near NULL (`0x8`), producing a SEGV read that crashes `ld`.

The upstream fix checks the owning BFD's flavour before reading the ELF section flags, returning `SHN_COMMON` directly for non-ELF input:

```diff
static unsigned int
elf_x86_64_common_section_index (asection *sec)
{
- if ((elf_section_flags (sec) & SHF_X86_64_LARGE) == 0)
+ if (bfd_get_flavour (sec->owner) != bfd_target_elf_flavour
+ || (elf_section_flags (sec) & SHF_X86_64_LARGE) == 0)
return SHN_COMMON;
else
return SHN_X86_64_LCOMMON;
}
```

With the fix, the linker gets an assertion failure at `bfd/coffgen.c:575` for such input and exits with a proper error instead of a segmentation fault.

## Steps to Reproduce

The following commands assume this report's `pocs` directory sits next to the built `binutils-gdb` directory:

```bash
git clone https://sourceware.org/git/binutils-gdb.git binutils-gdb
cd binutils-gdb
git checkout 640a79623
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu MAKEINFO=true
make -j
```

The binutils 2.47 release tarball (version date `20260726`) also reproduces. Run the PoC:

```bash
export ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
./ld/ld-new -r -o /dev/null ../pocs/34449/bug_0.o
```

Expected result on the vulnerable version:

```text
==64971==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008
The signal is caused by a READ memory access.
#0 elf_x86_64_common_section_index bfd/elf64-x86-64.c:6093
#1 elf_link_output_extsym bfd/elflink.c:10941
#2 bfd_hash_traverse bfd/hash.c:814
#3 _bfd_elf_final_link bfd/elflink.c:13380
#4 ldwrite ld/ldwrite.c:548
SUMMARY: AddressSanitizer: SEGV in elf_x86_64_common_section_index
```


## Impact

A crafted object file can crash `ld` during the symbol output stage of a relocatable link, causing denial of service. Any toolchain, build system, or CI pipeline that exposes GNU ld to untrusted input files can be terminated by this malformed common-symbol input.

## Recommended Fix

Apply upstream commit `7322e9bc30cb282575a701c307851fd3d66fee68` ("x86-64: Return SHN_COMMON on non-ELF input"), or upgrade to a binutils version containing the fix. The patch stops the x86-64 backend from accessing ELF section flags when the section's owning BFD is not of ELF flavour, so bad input gets an assertion error instead of a crash.

Keep the mixed-format (PE/x86-64) object file with `ld -r` case in regression testing to prevent this class of format assumption from being reintroduced.

------

## References

- Bugzilla issue 34449: https://sourceware.org/bugzilla/show_bug.cgi?id=34449
- PoC attachment (bug_0): https://sourceware.org/bugzilla/attachment.cgi?id=16881
- Fix commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7322e9bc30cb282575a701c307851fd3d66fee68
- Affected versions: binutils 2.47 (version date 20260726) / dev snapshot commit 640a79623
- Binutils repository: https://sourceware.org/git/?p=binutils-gdb.git
- Reproduction materials (PoC): https://github.com/Ech06/CVE_submit/tree/main/bugzilla/pocs/34449

## Notes

The original report described the crash as a dereference of a NULL `sec`; the actual fix shows the crash stems from calling `elf_section_flags()` on a non-ELF section (whose ELF-specific data is NULL), and the observed fault address `0x8` matches reading a member at that offset from a NULL structure. The fix commit was authored by H.J. Lu on 2026-07-30 and pushed to master on 2026-08-04.

• Source: ⚠️ https://github.com/Ech06/CVE_submit/tree/main/bugzilla/pocs/34449
• User: Ech06 (UID 98792)
• Submission: 08/16/2026 13:05 (1 month ago)
• Moderation: 09/15/2026 04:01 (30 days later)
• Status: Accepted
• VulDB entry: 404052 [GNU Binutils 2.47 ELF Section bfd/elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference]
• Points: 20