CVE-2025-69651: 
NixOS vulnerability analysis and mitigation

CVE-2025-69651 is an invalid pointer free vulnerability in GNU Binutils readelf (through version 2.46) that can be triggered by processing a crafted ELF binary with malformed relocation or symbol data. When dump_relocations() returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized, causing process_got_section_contents() to later attempt to free an invalid r_symbol pointer. This triggers memory corruption checks in glibc and terminates the program with SIGABRT, resulting in a denial of service. The CVE is disputed by third parties who note the observed behavior occurred only in pre-release code and did not affect any tagged release version. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Sourceware Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference), though the actual mechanism involves an invalid pointer free rather than a strict null dereference. The vulnerability is local and requires user interaction — an attacker must convince a user or automated tooling to run readelf against a specially crafted ELF binary. When dump_relocations() encounters malformed relocation or symbol data and exits early, the all_relocations array is left partially uninitialized. A subsequent call to process_got_section_contents() then attempts to free the invalid r_symbol pointer, which glibc's memory allocator detects as corruption, triggering SIGABRT. No code execution or further memory corruption beyond the crash was observed (Feedly, Sourceware Bugzilla).

The confirmed impact is limited to denial of service — specifically, abnormal termination of the readelf process via SIGABRT. There is no evidence of confidentiality or integrity impact, and no code execution has been demonstrated. The vulnerability affects only the readelf utility itself and does not propagate to the underlying operating system or other processes, making lateral movement or data exfiltration scenarios implausible (Feedly).

No public exploit code has been confirmed for CVE-2025-69651; the Sourceware Bugzilla entry referenced as an exploit source returned only a bot-protection page with no technical details (Feedly). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.022%, reflecting a very low probability of exploitation in the near term. Additionally, the vulnerability is disputed, as it reportedly only manifested in pre-release Binutils code and did not affect any officially tagged release (Feedly).

1. Craft malicious ELF binary: Create or modify an ELF binary to contain malformed relocation or symbol table data that causes dump_relocations() to return early, leaving the all_relocations array partially uninitialized.
2. Deliver the binary: Convince a user or automated build/analysis pipeline to process the crafted ELF file with readelf (e.g., via a code review tool, CI/CD pipeline, or direct social engineering).
3. Trigger the crash: Run readelf against the crafted binary (e.g., readelf -a malicious.elf). The early return in dump_relocations() leaves invalid state, and the subsequent call to process_got_section_contents() attempts to free an invalid r_symbol pointer.
4. Observe denial of service: glibc detects the invalid free, triggers memory corruption checks, and terminates readelf with SIGABRT, causing a denial of service for any process or pipeline depending on readelf output (Sourceware Bugzilla, Feedly).

• Process: readelf process terminating unexpectedly with SIGABRT signal when processing ELF binaries.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing entries like readelf: SIGABRT or glibc error messages such as free(): invalid pointer or malloc: corrupted top size associated with readelf invocations.
• File System: Presence of unusual or unexpected ELF binaries submitted to analysis pipelines or build systems, particularly those with malformed section headers, relocation tables, or symbol tables.
• Core Dumps: Core dump files generated by readelf crashes (if core dumps are enabled), which may indicate repeated exploitation attempts against automated tooling.

A patch has been committed to the Binutils-GDB repository (commit ea4bc025abdba85a90e26e13f551c16a44bfa921) addressing the invalid pointer free (Sourceware patch). Users should update to a patched version of GNU Binutils once an official tagged release incorporating this fix is available. As a workaround, avoid running readelf or other Binutils tools against untrusted ELF binaries, particularly in automated pipelines. Fedora users can apply the mingw-binutils update (Fedora advisory 2026-fe96f3532b) which addresses this and related issues (Linux Security). Given the disputed nature of this CVE and its limited impact (DoS only), remediation priority should be considered low.

The CVE is formally disputed by third parties who assert the vulnerability only manifested in pre-release Binutils code and did not affect any officially tagged version, which has tempered community concern (Feedly). The Yocto Project security mailing list has tracked this CVE across multiple weekly CVE metrics reports, indicating it is being monitored by embedded Linux communities (Yocto Security List). Coverage has been minimal, with only a few automated vulnerability aggregators and minor security news outlets reporting on it.