Executive brief
A vulnerability exists in the GNU Binutils linker, a tool used by developers to combine compiled code into executable programs. An attacker with local access to a system could provide a specially crafted file that causes the linker to crash or behave unexpectedly. This could disrupt software development processes or be used as part of a more complex attack chain, though it does not directly allow for data theft or remote control.
Technical details
An out-of-bounds read vulnerability exists in GNU Binutils 2.45 within the bfd_elf_gc_record_vtentry function in bfd/elflink.c. The issue is caused by a lack of sanity checking on addends in VTENTRY relocations, which can lead to an expression overflow or an attempt to allocate an excessively large array, resulting in a segmentation fault (SEGV). An attacker with local access can trigger this by providing a malicious object file to the linker (ld). A patch has been developed (commit 047435dd988a3975d40c6626a8f739a0b2e154bc) which implements a sanity check on the addend values.
Affected products
- GNU Binutils 2.45
Timeline
- 2025-09-18: disclosed: Initial bug report in Sourceware Bugzilla
- 2025-09-25: patched: Patch committed to master branch
- 2025-10-07: advisory: CVE-2025-11412 published
References
- https://sourceware.org/bugzilla/attachment.cgi?id=16378
- https://sourceware.org/bugzilla/show_bug.cgi?id=33452
- https://sourceware.org/bugzilla/show_bug.cgi?id=33452
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc
- https://vuldb.com/?ctiid.327348
- https://vuldb.com/?id.327348
- https://www.gnu.org/