CVE-2026-35233 — Denial of Service

title: Suspicious ELF Binary with Out-of-Range sh_link Field Attempting to Trigger dtrace DoS — CVE-2026-35233
id: scw-2026-05-01-ai-1
status: experimental
level: high
description: |
  This rule detects the execution of a suspicious ELF binary (named 'elf_parser_test' for specificity, as a crafted binary would likely have a unique name) that is being instrumented by dtrace. The 'dtrace -p' command indicates dtrace attaching to a specific process ID. The vulnerability occurs when dtrace parses an ELF binary with an out-of-range sh_link field, leading to a NULL pointer dereference and Denial of Service. This rule specifically targets the attachment of dtrace to a process that is likely running the malicious ELF binary, which is the trigger for the CVE-2026-35233 vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-01
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-35233/
tags:
  - attack.defense_evasion
  - attack.t1499
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - '/elf_parser_test'
      CommandLine|contains:
          - '-p'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse