https://sourceware.org/bugzilla/show_bug.cgi?id=34445
Bug ID: 34445
Summary: ld: heap OOB write / negative-size memmove / SEGV in
_bfd_elf_write_section_eh_frame
(bfd/elf-eh-frame.c:2064/2083/2193) via malformed
.eh_frame
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16871
--> https://sourceware.org/bugzilla/attachment.cgi?id=16871&action=edit
PoC (bug_14)
Summary
A malformed `.eh_frame` section drives three crashes in the eh_frame write path
of `_bfd_elf_write_section_eh_frame`, all likely rooted in unvalidated CIE/FDE
augmentation or buffer bounds during final link:
Likely one root cause in the eh_frame write path. Security-relevant — heap OOB
write (bug_14) and a `memmove` with a negative (huge) size (bug_20).
This may be an incomplete fix for bug 32642.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`) — all three
reproduced.
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`).
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --shared -z relro -o /dev/null bug_14.o #
:2083 HBO
ld --version-exports-section symbol --shared -o /dev/null bug_20.o #
:2064 neg-size
ld --gc-sections --no-print-gc-sections -w -o /dev/null bug_8.o #
:2193 SEGV
Error Log
bug_14 (:2083 HBO):
==65181==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x529000013200 at pc 0x58f9cfce715b bp 0x7ffc601eac50 sp 0x7ffc601eac40
#0 _bfd_elf_write_section_eh_frame
/home/user/build/binutils-2.47/bfd/elf-eh-frame.c:2083
#1 elf_link_input_bfd
/home/user/build/binutils-2.47/bfd/elflink.c:12218
#2 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13189
#3 ldwrite
/home/user/build/binutils-2.47/ld/ldwrite.c:548
SUMMARY: AddressSanitizer: heap-buffer-overflow elf-eh-frame.c:2083 in
_bfd_elf_write_section_eh_frame
bug_20 (:2064 negative-size-param):
==65893==ERROR: AddressSanitizer: negative-size-param: (size=-1)
#0 __interceptor_memmove
#1 memmove
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:36
#2 _bfd_elf_write_section_eh_frame
/home/user/build/binutils-2.47/bfd/elf-eh-frame.c:2064
#3 elf_link_input_bfd
/home/user/build/binutils-2.47/bfd/elflink.c:12218
#4 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13189
SUMMARY: AddressSanitizer: negative-size-param in __interceptor_memmove
(caller: elf-eh-frame.c:2064)
bug_8 (:2193 SEGV):
==65091==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc
0x5e9765c35135 ...)
#0 _bfd_elf_write_section_eh_frame
/home/user/build/binutils-2.47/bfd/elf-eh-frame.c:2193
#1 elf_link_input_bfd
/home/user/build/binutils-2.47/bfd/elflink.c:12218
#2 _bfd_elf_final_link
/home/user/build/binutils-2.47/bfd/elflink.c:13189
SUMMARY: AddressSanitizer: SEGV elf-eh-frame.c:2193 in
_bfd_elf_write_section_eh_frame
--
You are receiving this mail because:
You are on the CC list for the bug.
