mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-05-07 16:59:22 +00:00
Code Issues Projects Releases Wiki Activity

binutils: patch CVE-2025-1178 & CVE-2024-57360

Browse Source 
Backport Fixes for:

*CVE-2025-1178 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0]

*CVE-2024-57360 - Upstream-Status: Backport from  [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=5f8987d3999edb26e757115fe87be55787d510b9]

(From OE-Core rev: 15a7f68ce14f635acf9b988fc1958ee625de4e11)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Ashish Sharma
2025-04-15 14:28:39 +05:30
committed by Steve Sakoman
parent d13450d713
commit 757102953a
3 changed files with 115 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/binutils/binutils-2.42.inc
+2
View File
@@ -40,5 +40,7 @@ SRC_URI = "\
file://0017-dlltool-file-name-too-long.patch \
file://0018-CVE-2025-0840.patch \
file://CVE-2025-1176.patch \
file://CVE-2025-1178.patch \
file://CVE-2024-57360.patch \
"
S = "${WORKDIR}/git"
meta/recipes-devtools/binutils/binutils/CVE-2024-57360.patch
+75
View File
@@ -0,0 +1,75 @@
From 5f8987d3999edb26e757115fe87be55787d510b9 Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Tue, 17 Dec 2024 09:18:57 +0000
Subject: [PATCH] nm: Avoid potential segmentation fault when displaying
symbols without version info.
PR 32467
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0]
CVE: CVE-2024-57360
Signed-off-by: Ashish Sharma <asharma@mvista.com>
binutils/nm.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/binutils/nm.c b/binutils/nm.c
index faf27c59b4d..0ba7604d34f 100644
--- a/binutils/nm.c
+++ b/binutils/nm.c
@@ -682,7 +682,7 @@ print_symname (const char *form, struct extended_symbol_info *info,
const char *name, bfd *abfd)
{
char *alloc = NULL;
- char *atver = NULL;
+ char *atname = NULL;
if (name == NULL)
name = info->sinfo->name;
@@ -690,9 +690,19 @@ print_symname (const char *form, struct extended_symbol_info *info,
if (!with_symbol_versions
&& bfd_get_flavour (abfd) == bfd_target_elf_flavour)
{
- atver = strchr (name, '@');
+ char *atver = strchr (name, '@');
+
if (atver)
- *atver = 0;
+ {
+ /* PR 32467 - Corrupt binaries might include an @ character in a
+ symbol name. Since non-versioned symbol names can be in
+ read-only memory (via memory mapping of a file's contents) we
+ cannot just replace the @ character with a NUL. Instead we
+ create a truncated copy of the name. */
+ atname = xstrdup (name);
+ atname [atver - name] = 0;
+ name = atname;
+ }
}
if (do_demangle && *name)
@@ -703,9 +713,7 @@ print_symname (const char *form, struct extended_symbol_info *info,
}
if (unicode_display != unicode_default)
- {
- name = convert_utf8 (name);
- }
+ name = convert_utf8 (name);
if (info != NULL && info->elfinfo && with_symbol_versions)
{
@@ -726,8 +734,8 @@ print_symname (const char *form, struct extended_symbol_info *info,
}
}
printf (form, name);
- if (atver)
- *atver = '@';
+
+ free (atname);
free (alloc);
}
--
2.43.5
meta/recipes-devtools/binutils/binutils/CVE-2025-1178.patch
+38
View File
@@ -0,0 +1,38 @@
From 75086e9de1707281172cc77f178e7949a4414ed0 Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Wed, 5 Feb 2025 13:26:51 +0000
Subject: [PATCH] Prevent an abort in the bfd linker when attempting to
generate dynamic relocs for a corrupt input file.
PR 32638
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0]
CVE: CVE-2025-1178
Signed-off-by: Ashish Sharma <asharma@mvista.com>
bfd/elf64-x86-64.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
index 61334c3ab04..32db254ba6c 100644
--- a/bfd/elf64-x86-64.c
+++ b/bfd/elf64-x86-64.c
@@ -5303,6 +5303,15 @@ elf_x86_64_finish_dynamic_symbol (bfd *output_bfd,
if (generate_dynamic_reloc)
{
+ /* If the relgot section has not been created, then
+ generate an error instead of a reloc. cf PR 32638. */
+ if (relgot == NULL || relgot->size == 0)
+ {
+ info->callbacks->einfo (_("%F%pB: Unable to generate dynamic relocs because a suitable section does not exist\n"),
+ output_bfd);
+ return false;
+ }
+
if (relative_reloc_name != NULL
&& htab->params->report_relative_reloc)
_bfd_x86_elf_link_report_relative_reloc
--
2.43.5