CVE-2025-11495

Executive Summary

CVE-2025-11495 is a heap-based buffer overflow vulnerability in GNU Binutils 2.45, specifically within the elf_x86_64_relocate_section function in elf64-x86-64.c. This flaw allows a local attacker to cause a denial of service (DoS) by providing a crafted ELF file that triggers a heap overflow during the linking process. The vulnerability has a low CVSS score of 3.3 due to its local attack vector and limited impact (availability only). A patch is available in the upstream repository.

Supply Chain & Package Security

This vulnerability affects the GNU Binutils package, which is a critical component in many Linux distributions and build toolchains. While not a direct supply chain attack vector (e.g., NPM, PyPI), a compromised or malicious ELF file processed by the linker could lead to system instability. Organizations should ensure their build environments are updated to patched versions of binutils.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Base Score: 3.3 (Low)
• Attack Vector: Local (AV:L) – Requires local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs user-level access.
• User Interaction: None (UI:N) – No user action needed beyond running the linker.
• Scope: Unchanged (S:U) – Impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – Can cause a crash or denial of service.

Threat Level: Low. The vulnerability is local-only and requires an attacker to have access to the system. The primary risk is a denial of service against the linker, potentially disrupting build processes.

Deep Dive & Mechanics

The vulnerability resides in the elf_x86_64_relocate_section function within elf64-x86-64.c. This function is responsible for performing relocations on x86-64 ELF objects during the linking phase. A heap-based buffer overflow occurs when the function processes a specially crafted ELF file with malformed relocation entries.

The root cause is an insufficient bounds check when writing relocation data to a heap-allocated buffer. An attacker can craft an ELF file with an excessive number of relocations or with relocation entries that cause the function to write beyond the allocated buffer, leading to heap corruption. This can result in a crash (DoS) or, in more complex scenarios, potentially arbitrary code execution, though the CVSS score reflects only availability impact.

The vulnerable code path is triggered when ld (the GNU linker) processes the malicious ELF file. The overflow occurs in the handling of the R_X86_64_* relocation types.

Vulnerable vs. Patched Code

Vulnerable Code (Binutils 2.45): The vulnerable code in elf64-x86-64.c lacks proper validation of the relocation count or the size of the output buffer. A simplified representation:

// Vulnerable: No bounds check on relocation count
static bfd_boolean
elf_x86_64_relocate_section (bfd *output_bfd, struct bfd_link_info *info,
                             bfd *input_bfd, asection *input_section,
                             bfd_byte *contents, Elf_Internal_Rela *relocs,
                             Elf_Internal_Sym *local_syms, asection **local_sections)
{
  // ... 
  for (i = 0; i < reloc_count; i++)
  {
    // Direct write to heap buffer without size check
    *ptr++ = some_value; // Potential overflow
  }
}

Patched Code (Commit 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0): The patch adds a bounds check to ensure the write does not exceed the allocated buffer size.

// Patched: Added bounds check
static bfd_boolean
elf_x86_64_relocate_section (bfd *output_bfd, struct bfd_link_info *info,
                             bfd *input_bfd, asection *input_section,
                             bfd_byte *contents, Elf_Internal_Rela *relocs,
                             Elf_Internal_Sym *local_syms, asection **local_sections)
{
  // ...
  size_t max_size = ...; // Calculated from buffer size
  for (i = 0; i < reloc_count; i++)
  {
    if (ptr - buffer_start >= max_size) {
      // Handle error or break
      break;
    }
    *ptr++ = some_value;
  }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system with GNU Binutils 2.45 installed.
• Ability to create a malicious ELF file.

Exploitation Steps:

1. Craft a malicious ELF file: Create an ELF object file with an excessive number of relocation entries or malformed relocation data that triggers the heap overflow. This can be done using a hex editor or by modifying an existing ELF file.
2. Run the linker: Execute ld (or gcc which invokes ld) on the malicious file.

   ld -o output malicious.o
   

3. Observe crash: The linker will likely crash due to heap corruption, resulting in a denial of service.

Note: No public exploit code is available at this time. The vulnerability is primarily a DoS vector.

Blue Team

Detection:

• Monitor for crashes of the ld process.
• Use file integrity monitoring to detect unexpected ELF files.
• Implement behavioral detection for unusual linker activity.

Hunting:

• Search for ELF files with abnormally high relocation counts.
• Analyze core dumps from ld crashes for signs of heap corruption.

Mitigation:

• Apply the patch immediately.
• Restrict local user access to systems where untrusted ELF files may be processed.

Indicators of Compromise (IOCs)

• File Hashes: (No specific hashes available; generic malicious ELF files)
• Process Names: ld, collect2, gcc (when invoking the linker)
• Log Entries: Core dumps or crash logs from ld with heap corruption errors.
• Network: None (local vulnerability)

Detection Engineering

YARA Rule

rule CVE_2025_11495_Heap_Overflow {
    meta:
        description = "Detects ELF files with excessive relocations targeting CVE-2025-11495"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11495"
    strings:
        $elf_magic = { 7f 45 4c 46 } // ELF magic
        $rela_type = { 08 00 00 00 } // Example: R_X86_64_RELATIVE
    condition:
        $elf_magic at 0 and
        // Check for high relocation count (e.g., > 10000)
        uint32(uint32(0x20) + 0x18) > 10000
}

Sigma Rule

title: CVE-2025-11495 - Heap Overflow in GNU Binutils Linker
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes of the GNU linker (ld) potentially caused by CVE-2025-11495
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ld'
        CommandLine|contains: 'ld'
    condition: selection
falsepositives:
    - Legitimate linker operations with large files
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11495 - Potential ELF file with excessive relocations"; flow:to_server; content:"|7f 45 4c 46|"; offset:0; depth:4; content:"|08 00 00 00|"; within:100; byte_test:4,>,10000,0x20; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the Patch: Update GNU Binutils to a version that includes commit 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 or later.
2. Package Updates: Install updated packages from your Linux distribution (e.g., apt-get update && apt-get upgrade binutils on Debian/Ubuntu, yum update binutils on RHEL/CentOS).
3. Workaround: If patching is not immediately possible, restrict local user access and avoid processing untrusted ELF files.
4. Monitoring: Implement the detection rules above to identify potential exploitation attempts.

Valters IT