CVE-2025-11412

Executive Summary

CVE-2025-11412 is a low-severity (CVSS 3.3) out-of-bounds read vulnerability in GNU Binutils 2.45, specifically within the linker component (bfd/elflink.c). The flaw resides in the bfd_elf_gc_record_vtentry function, which is invoked during the linking process when processing ELF object files. An attacker with local access can craft a malicious ELF file that, when processed by the linker, triggers an out-of-bounds read. While the direct impact is limited to information disclosure (potential memory leak), the vulnerability has been publicly disclosed with a proof-of-concept, and a patch is available. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance.

Supply Chain & Package Security

This vulnerability affects GNU Binutils, a critical component in the software supply chain for Linux and Unix-like systems. Binutils is used by developers, build systems, and package managers to compile and link software. A compromised linker could lead to the insertion of malicious code or extraction of sensitive data during the build process. However, the local access requirement and low severity reduce the immediate supply chain risk. Organizations should prioritize patching Binutils in development and build environments.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a standard user account.
• User Interaction (UI): None (N) – No user action needed beyond running the linker.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. The vulnerability requires local access and only allows limited information disclosure. However, the public availability of exploit details increases the risk for environments where untrusted users can execute the linker.

Deep Dive & Mechanics

The vulnerability is in the bfd_elf_gc_record_vtentry function within bfd/elflink.c. This function is part of the garbage collection (GC) mechanism for ELF sections, specifically handling vtables for C++ virtual function entries. The function processes relocation entries to track which vtable entries are referenced.

The root cause is an improper bounds check when accessing an array of vtable entries. The function uses an index derived from the relocation offset without verifying that it falls within the allocated array size. This leads to an out-of-bounds read, potentially exposing adjacent memory contents.

Code Flow:

1. The linker processes an ELF object file with a .rela.dyn or .rela.plt section containing relocations.
2. For each relocation, bfd_elf_gc_record_vtentry is called with the relocation's addend.
3. The function calculates an index into an internal array of vtable entries.
4. Due to missing bounds checking, an attacker-controlled addend can cause the index to exceed the array bounds.
5. The function reads from the out-of-bounds memory location, potentially leaking data.

Impact: An attacker can craft a malicious object file that, when linked, causes the linker to read memory outside the intended buffer. This could leak sensitive information from the linker's memory space, such as addresses or other data.

Vulnerable vs. Patched Code

Vulnerable Code (GNU Binutils 2.45):

// bfd/elflink.c (simplified)
static void
bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec, bfd_vma addend)
{
  struct elf_link_hash_table *htab = elf_hash_table (info);
  struct elf_gc_vtentry *entry;
  unsigned int index;

  // Vulnerable: No bounds check on addend
  index = (unsigned int) addend;
  entry = &htab->gc_vtentry_entries[index]; // Out-of-bounds read
  // ... process entry
}

Patched Code (after commit 047435dd988a3975d40c6626a8f739a0b2e154bc):

// bfd/elflink.c (patched)
static void
bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec, bfd_vma addend)
{
  struct elf_link_hash_table *htab = elf_hash_table (info);
  struct elf_gc_vtentry *entry;
  unsigned int index;

  index = (unsigned int) addend;
  // Added bounds check
  if (index >= htab->gc_vtentry_count)
    return; // or handle error
  entry = &htab->gc_vtentry_entries[index];
  // ... process entry
}

The patch adds a simple bounds check (if (index >= htab->gc_vtentry_count) return;) to prevent the out-of-bounds access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system with GNU Binutils 2.45 installed.
• Ability to compile and run a C program or craft a malicious ELF file.

Exploitation Steps:

1. Create a malicious ELF object file with a crafted relocation entry that has a large addend value.
2. Use the linker (ld) to process this object file.
3. The out-of-bounds read will occur, potentially leaking memory contents.

Proof-of-Concept (PoC):

// poc.c - Compile with: gcc -c poc.c -o poc.o
// Then link: ld -r -o output.o poc.o
// The linker will trigger the OOB read.

#include <stdio.h>

// This structure is crafted to trigger the vulnerability
struct __attribute__((packed)) fake_vtable {
    void (*func)(void);
};

void dummy_func() {
    printf("Dummy\n");
}

struct fake_vtable vtable = { dummy_func };

int main() {
    // The relocation will have a large addend
    void (*func_ptr)(void) = vtable.func;
    func_ptr();
    return 0;
}

Note: The actual exploitation requires crafting a specific ELF binary with a relocation entry that has an out-of-bounds addend. The above PoC is a simplified illustration.

Blue Team

Detection:

• Monitor linker processes (ld, collect2) for crashes or abnormal behavior.
• Use the detection rules provided below to identify exploitation attempts.

Mitigation:

• Apply the patch immediately (commit 047435dd988a3975d40c6626a8f739a0b2e154bc).
• Restrict local access to systems where untrusted users can run the linker.
• Use security tools to monitor for suspicious ELF files.

Indicators of Compromise (IOCs)

• File Hashes: (None specific to this CVE)
• Process Anomalies: Linker process (ld) crashes with SIGSEGV or SIGABRT.
• Log Entries: System logs showing linker errors or segmentation faults.
• Network: No network indicators (local vulnerability).
• YARA Rule: See Detection Engineering section.

Detection Engineering

YARA Rule

rule CVE_2025_11412_Binutils_OOB_Read {
    meta:
        description = "Detects ELF files crafted to exploit CVE-2025-11412 in GNU Binutils"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11412"
        hash = "047435dd988a3975d40c6626a8f739a0b2e154bc"
    strings:
        $elf_magic = { 7f 45 4c 46 } // ELF magic
        $rela_type = { 08 00 00 00 } // R_X86_64_RELATIVE (example)
        $large_addend = { ff ff ff ff } // Potential large addend
    condition:
        $elf_magic at 0 and $rela_type and #large_addend > 5
}

Sigma Rule

title: CVE-2025-11412 Binutils Out-of-Bounds Read
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-11412 via linker crashes
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11412
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ld'
        CommandLine|contains: '--gc-sections'
    condition: selection
falsepositives:
    - Legitimate use of --gc-sections flag
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-11412 Binutils OOB Read Attempt"; flow:to_server; content:"|7f 45 4c 46|"; offset:0; depth:4; content:"|08 00 00 00|"; within:20; reference:cve,2025-11412; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply Patch: Update GNU Binutils to a version that includes commit 047435dd988a3975d40c6626a8f739a0b2e154bc or later.
2. Restrict Access: Limit local access to systems where the linker is used, especially in multi-user environments.
3. Monitor: Implement detection rules to identify exploitation attempts.
4. Least Privilege: Run linker processes with minimal privileges.
5. Regular Updates: Keep Binutils and other development tools up to date.

Valters IT
Securing Digital Frontiers