https://sourceware.org/bugzilla/show_bug.cgi?id=34444
Bug ID: 34444
Summary: ld: heap OOB read/write in elf_x86_64_relocate_section
(bfd/elf64-x86-64.c:4530 / :4835) via malformed
relocation
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16868
--> https://sourceware.org/bugzilla/attachment.cgi?id=16868&action=edit
PoC
Summary
A malformed relocation whose `roff` underflows drives out-of-bounds `bfd_get_8`
/ `bfd_put_8` accesses at `contents + roff - 5` / `contents + roff - 2` inside
`elf_x86_64_relocate_section`. Three fuzzing signatures map to this root cause,
at two adjacent lines of the same function:
| bug | type | site | flags
|
|--------|----------------------|---------------------|-------------------------------------------|
| bug_12 | heap-buffer-overflow | elf64-x86-64.c:4530 | `--gc-sections
--no-print-gc-sections -w` |
| bug_15 | heap-buffer-overflow | elf64-x86-64.c:4835 | `--gc-sections
--no-print-gc-sections -w` |
| bug_19 | SEGV | elf64-x86-64.c:4835 |
`--version-exports-section symbol` |
bug_15 and bug_19 are the same line (HBO vs SEGV depending on the exact `roff`
value).
Likely one root cause (unvalidated `roff` against `contents` size); file as a
single issue listing all three sites. Security-relevant — heap OOB write on the
relocation contents buffer.
This is the same crash site as previously-reported bug 33502.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`) — all three
reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_12.o # :4530 HBO
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_15.o # :4835 HBO
ld --version-exports-section symbol -o /dev/null bug_19.o # :4835 SEGV
Error Log
bug_12 (:4530 HBO):
==65151==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x5290000141ff at pc 0x5648228c8cfe bp 0x7ffc0d8dab10 sp 0x7ffc0d8dab00
#0 elf_x86_64_relocate_section
/home/user/build/binutils-2.47/bfd/elf64-x86-64.c:4530
#1 elf_link_input_bfd
/home/user/build/binutils-2.47/bfd/elflink.c:11926
#2 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13189
#3 ldwrite
/home/user/build/binutils-2.47/ld/ldwrite.c:548
SUMMARY: AddressSanitizer: heap-buffer-overflow elf64-x86-64.c:4530 in
elf_x86_64_relocate_section
bug_15 (:4835 HBO):
==65571==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x52900001e708 at pc 0x64a7e55b5525 bp 0x7fff5700a020 sp 0x7fff5700a010
#0 elf_x86_64_relocate_section
/home/user/build/binutils-2.47/bfd/elf64-x86-64.c:4835
SUMMARY: AddressSanitizer: heap-buffer-overflow elf64-x86-64.c:4835 in
elf_x86_64_relocate_section
bug_19 (:4835 SEGV):
==65878==ERROR: AddressSanitizer: SEGV on unknown address 0x529000134202 (pc
0x63acbbb263b9 ...)
#0 elf_x86_64_relocate_section
/home/user/build/binutils-2.47/bfd/elf64-x86-64.c:4835
SUMMARY: AddressSanitizer: SEGV elf64-x86-64.c:4835 in
elf_x86_64_relocate_section
--
You are receiving this mail because:
You are on the CC list for the bug.
