Skip to content

Fixes alignment in ELF shared object templates - #21027

Merged
msutovsky-r7 merged 3 commits into
rapid7:masterfrom
SilentSobs:fix/armle-elf-so-alignment
Apr 11, 2026
Merged

Fixes alignment in ELF shared object templates#21027
msutovsky-r7 merged 3 commits into
rapid7:masterfrom
SilentSobs:fix/armle-elf-so-alignment

Conversation

@SilentSobs

Copy link
Copy Markdown
Contributor

The _start label in the ARM LE ELF shared object template was landing
at offset 0xF6, which is half-word aligned but not word aligned.

ARM A32 requires 4-byte (word) alignment the least significant two
bits of the entry point address must always be zero. 0xF6 violates
this, causing the shared object to fail to load and execute on 32-bit
ARM Linux targets when using --format elf-so.

Fix: added 2 null padding bytes between strtab and _start in
elf_dll_armle_template.s, pushing the entry point from 0xF6 to
0xF8 (word aligned). The compiled template_armle_linux_dll.bin has
been regenerated with nasm.

Fixes #19668

Verification:

  • Generate an elf-so payload for armle:
    msfvenom --arch armle --platform linux --payload linux/armle/exec --format elf-so -o test.so CMD="id"
  • Verify entry point is word-aligned:
    readelf -h test.so → Entry point address: 0xf8 ✅
  • Confirmed by original reporter (sfewer-r7) that this fix works on a real 32-bit ARM Linux target (issue ARM32 LE Shared Object template alignment issue #19668)
  • No regression on x86 elf-so (entry: 0xf6, correct) and x64 elf-so (entry: 0x192, correct)

The _start label in the armle ELF shared object template was landing
at offset 0xF6, which is half-word aligned but not word aligned.

ARM A32 requires 4-byte (word) alignment for instruction addresses.
This caused the shared object to fail to load and execute on 32-bit
ARM Linux targets.

Fix: add 2 null padding bytes between strtab and _start, pushing the
entry point from 0xF6 to 0xF8 (word aligned).

Fixes rapid7#19668
Comment thread data/templates/template_armle_linux_dll.bin
Comment thread data/templates/src/elf/dll/elf_dll_armle_template.s
@msutovsky-r7 msutovsky-r7 changed the title fix: correct ARM LE ELF SO entry point alignment #19668 Fixes alignment in ELF shared object file for ARM Apr 9, 2026
@msutovsky-r7

Copy link
Copy Markdown
Contributor

Also noticed that the same bug might be introduced in riscv32le, so that should be addressed as well.

@msutovsky-r7 msutovsky-r7 changed the title Fixes alignment in ELF shared object file for ARM Fixes alignment in ELF shared object file Apr 9, 2026
@msutovsky-r7 msutovsky-r7 added payload bug rn-fix release notes fix labels Apr 9, 2026
@msutovsky-r7 msutovsky-r7 changed the title Fixes alignment in ELF shared object file Fixes alignment in ELF shared object template Apr 9, 2026
@msutovsky-r7 msutovsky-r7 changed the title Fixes alignment in ELF shared object template Fixes alignment in ELF shared object templates Apr 9, 2026
@github-project-automation github-project-automation Bot moved this from Todo to In Progress in Metasploit Kanban Apr 9, 2026
@msutovsky-r7

Copy link
Copy Markdown
Contributor

Release Notes

Fixes ELF shared object (elf-so) payload generation failing on 32-bit ARM Linux and RISC-V 32-bit LE targets. The _start entry point in the ARM LE template was landing at a non-word-aligned offset, which violates the architecture's 4-byte alignment requirement and caused the shared object to fail to load. The templates now use proper NASM align directives to ensure correct entry point alignment, and a similar fix is applied to the RISC-V 32-bit LE template.

@msutovsky-r7
msutovsky-r7 merged commit e79b3cf into rapid7:master Apr 11, 2026
67 of 76 checks passed
@github-project-automation github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Apr 11, 2026