CVE-2025-5244

What it actually does

Memory corruption in the elf_gc_sweep function within bfd/elflink.c of the ld component, triggered by crafted input during linking operations.

Why it matters to the business

Build pipelines and development toolchains using affected Binutils versions may experience crashes or unreliable behavior during linking, delaying software compilation and increasing operational overhead for maintainers.

How an attack unfolds

An attacker with local access supplies a malicious object file or library to the linker, triggering the vulnerable elf_gc_sweep path to corrupt memory structures and potentially influence process behavior.

How to fix it

Upgrade GNU Binutils to version 2.45 or apply the fix at commit 2bc7af1ff7732451b6a7b09462a815c3284f9613 in the binutils-gdb repository; rebuild any downstream packages that embed the affected ld binary.

How to confirm the fix worked

Confirm the installed ld binary reports version 2.45 or later, or verify the presence of the correcting commit in the source tree; test linking of representative ELF inputs to ensure no crashes occur under expected workloads.

Typical attack path

1. Obtain local access to a system with vulnerable Binutils ld
2. Craft or obtain an ELF object file designed to exercise the elf_gc_sweep code path
3. Invoke the linker (ld) against the malicious input
4. Trigger memory corruption during garbage collection of ELF sections
5. Observe resulting process instability or attempt further memory manipulation

How to detect it

Review system logs and process accounting for unexpected ld crashes or segmentation faults during linking jobs; inspect build server audit trails for invocation of ld with untrusted object files around the time of any observed instability.

What your security team should do

• Prioritize upgrade of Binutils in all build environments and CI pipelines within the next maintenance window
• Scan package repositories and container images for versions prior to the fixed commit
• Restrict untrusted local users from invoking the linker against arbitrary inputs until patched
• Monitor upstream announcements for any additional backports or related issues