Executive brief
A vulnerability exists in the GNU Binutils linker, a tool used by developers to combine compiled code into executable programs. An attacker with local access to a system could provide a specially crafted file that causes the linker to crash or read memory outside of its intended boundaries. This could lead to a denial-of-service condition, potentially disrupting software development or build processes.
Technical details
An out-of-bounds read vulnerability exists in GNU Binutils 2.45 within the get_link_hash_entry function in bfd/elflink.c. The issue is triggered when the linker (ld) processes an ELF file with an unsorted symbol table where local symbols do not precede global symbols, and the elf_bad_symtab flag is not set. This can result in a segmentation fault (SEGV) during the final link stage. An attacker can exploit this locally by providing a malformed object file to the linker. The vulnerability was addressed in version 2.46 by implementing a check that returns an error when an unsorted symbol table is encountered.
Affected products
- GNU Binutils 2.45
Timeline
- 2025-09-18: disclosed: Bug reported to Sourceware Bugzilla
- 2025-09-23: patched: Fix committed to master branch
- 2025-10-07: advisory: CVE published
References
- https://sourceware.org/bugzilla/attachment.cgi?id=16361
- https://sourceware.org/bugzilla/show_bug.cgi?id=33450
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=aeaaa9af6359c8e394ce9cf24911fec4f4d23703
- https://vuldb.com/?ctiid.327350
- https://vuldb.com/?id.327350
- https://vuldb.com/?submit.665591
- https://www.gnu.org/