Be careful what you wish for
Posted May 23, 2026 19:20 UTC (Sat) by chmod (subscriber, #169510)In reply to: Be careful what you wish for by cyperpunks
Parent article: Vulnerabilities in various GTK-based PDF readers
I wouldn't say that the .note.gnu.build-id has anything to do with security. It is intended for debugging and profiling to have a key to lookup ELF binaries/debuginfo/sources, e.g. it can be used to query debuginfod. Even in the standard use-case, it is not cryptographically tied to the ELF content, it can be random or user-controlled, e.g.
echo 'int main() { return 42; }' |gcc -xc - -Wl,--build-id=0x0123456789012345678901234567890123456789
From what I have understood, the only requirement is to place 9 "magic" bytes (%PDF-1.4\n) in the first 1024 bytes of the ELF/PDF. I guess there are plenty of other possibilities aside the build id, like other notes or just between ELF segments.