BFD: Fix use-after-free from `_bfd_load_armap'
Fixes a use-after-free vulnerability in BFD's archive handling related to symbol map allocation.
This patch, a revision of a previous version, addresses a use-after-free vulnerability in the BFD library’s handling of archive symbol maps. The issue stems from memory allocated for symbol map entries being prematurely freed. The fix restructures the `_bfd_compute_and_push_armap’ function to manage temporary name pointers within local objalloc, ensuring that actual name strings are retained correctly and preventing the use-after-free condition. This addresses CVE-2026-19548.
- proposer
Submitted a revised patch to fix a use-after-free in BFD's archive symbol map handling, incorporating Alan Modra's changes and addressing memory release upon function failure.
“This has passed regression-testing across my usual 263 targets. Given the reduction of the change I've kept the function result casts in this revision. A separate clean-up with no functional change can be done separately. I note that the failure of `push_armap' does not cause the symbol cache to be discarded in the `keep_symdefs' case even though it probably should. I'll offer a separate chang…”
- reviewer
Approved the revised patch, noting that while they preferred the first version, this one is also acceptable.
“I was happy with v1, but this is good too.”
Technical Tradeoffs
- Improved memory safety by fixing use-after-free vs. potential minor increase in temporary memory usage during archive processing.
In Details
This patch in binutils/bfd/archive.c resolves a use-after-free vulnerability (CVE-2026-19548) related to _bfd_load_armap and _bfd_compute_and_push_armap. The core issue was that memory allocated for a symbol map was freed before it was fully processed, particularly when handling mapless archives. The fix ensures that local objalloc is used for temporary name pointers within _bfd_compute_and_push_armap, preventing premature deallocation of essential symbol data.
- use-after-free
- A memory corruption vulnerability where a program attempts to access memory after it has been deallocated, potentially leading to crashes or security exploits.
- BFD
- Binary File Descriptor library, a low-level interface used by binutils to handle various executable and object file formats.
- mapless archives
- Archive files that do not contain a symbol map, requiring specific handling during loading and processing.
- objalloc
- A memory allocation mechanism within BFD that manages memory for specific objects, often used for internal data structures.
- CVE-2026-19548
- A Common Vulnerabilities and Exposures identifier for a specific security flaw in the binutils BFD library related to archive handling.