CVE-2025-69650: GNU Binutils Double Free DoS Vulnerability

CVE-2025-69650 Overview

A double free vulnerability exists in GNU Binutils through version 2.46 within the readelf utility when processing crafted ELF binaries containing malformed relocation data. During GOT (Global Offset Table) relocation handling, the dump_relocations function may return early without properly initializing the all_relocations array. Subsequently, process_got_section_contents() passes an uninitialized r_symbol pointer to free(), triggering a double free condition that terminates the program with SIGABRT.

Critical Impact

This vulnerability enables denial of service attacks against systems processing untrusted ELF binaries. While no exploitable memory corruption or code execution has been observed, the ability to crash the readelf utility through malformed input poses risks in automated build systems, binary analysis pipelines, and security tooling that rely on Binutils for ELF processing.

Affected Products

• GNU Binutils through version 2.46
• Systems using readelf for ELF binary analysis
• Build environments and CI/CD pipelines processing untrusted ELF files

Discovery Timeline

• 2026-03-06 - CVE-2025-69650 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-69650

Vulnerability Analysis

The vulnerability stems from improper memory management in the readelf component of GNU Binutils. When readelf processes an ELF binary with specially crafted malformed relocation data, a control flow issue arises in the GOT relocation handling path. The dump_relocations function contains an early return condition that can be triggered by malformed input, causing it to exit before properly initializing the all_relocations array.

This uninitialized state propagates to the process_got_section_contents() function, which subsequently attempts to free memory through the r_symbol pointer. Since this pointer was never properly initialized, calling free() on it results in undefined behavior—specifically, a double free condition where the same memory region may be freed twice or an invalid pointer is passed to the memory allocator.

Root Cause

The root cause is a CWE-415 (Double Free) vulnerability arising from insufficient initialization of the all_relocations array in error handling paths within dump_relocations. When the function returns early due to malformed relocation data, the caller (process_got_section_contents()) is unaware that the pointer remains uninitialized and proceeds to call free() on it. This represents a classic case of improper resource management where cleanup routines execute without verifying proper initialization state.

Attack Vector

The attack vector is network-accessible, as an attacker can craft a malicious ELF binary with malformed relocation sections and distribute it through various channels:

1. Supply chain attacks: Embedding malicious ELF files in software packages or repositories
2. Binary analysis services: Targeting online services that use readelf for ELF inspection
3. Build system exploitation: Submitting crafted binaries to CI/CD pipelines that perform automated analysis
4. Security tool disruption: Causing denial of service in security scanning tools that rely on Binutils

The attack requires no authentication or user interaction—simply processing the malformed ELF binary triggers the vulnerability. While the impact is limited to denial of service (program termination via SIGABRT), this can disrupt critical development and security workflows.

Detection Methods for CVE-2025-69650

Indicators of Compromise

• Unexpected readelf process terminations with SIGABRT signal
• Core dump files generated by readelf crashes indicating double free conditions
• Memory allocator error messages in system logs mentioning double free or corruption
• ELF files with abnormal or malformed relocation section structures

Detection Strategies

• Monitor for abnormal readelf process terminations in build environments and analysis pipelines
• Implement input validation for ELF files before processing with Binutils tools
• Deploy application crash monitoring to detect patterns of SIGABRT signals from readelf
• Use address sanitizer (ASAN) builds of Binutils in testing environments to catch memory errors

Monitoring Recommendations

• Enable core dump collection for Binutils utilities to capture crash artifacts for investigation
• Implement rate limiting and isolation for services that process untrusted ELF binaries
• Monitor system logs for glibc memory allocator errors indicating double free conditions
• Track Binutils version inventory across infrastructure to identify vulnerable deployments

How to Mitigate CVE-2025-69650

Immediate Actions Required

• Update GNU Binutils to a patched version that addresses this double free vulnerability
• Avoid processing untrusted or user-supplied ELF binaries with vulnerable Binutils versions
• Implement sandboxing for ELF binary analysis workflows to contain potential crashes
• Review and audit systems where readelf processes external input automatically

Patch Information

The vulnerability has been addressed in the upstream GNU Binutils repository. The fix is available in commit ea4bc025abdba85a90e26e13f551c16a44bfa921. Organizations should apply this patch or update to a Binutils version that includes this fix. For detailed information about the bug and patch, refer to the Sourceware Bug Report #33698 and the Sourceware Git Commit.

Workarounds

• Isolate readelf processes using containers or sandboxes to prevent denial of service from affecting other system components
• Implement pre-validation of ELF files using alternative tools before processing with Binutils
• Limit exposure by restricting which systems can receive and process untrusted ELF binaries
• Deploy watchdog processes to automatically restart crashed analysis services

# Configuration example: Running readelf in isolated environment
# Use firejail or similar sandboxing to contain potential crashes
firejail --quiet --noprofile --private readelf -a suspicious_binary.elf

# Alternative: Use timeout to prevent hanging and limit resource impact
timeout --signal=KILL 30s readelf -a untrusted_binary.elf