mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-12 03:10:06 +00:00
Code Issues Projects Releases Wiki Activity

binutils: patch CVE-2025-11412

Browse Source 
Pick commit per NVD CVE report.

(From OE-Core rev: 6b94ff6c584a31d2b1e06d1e1dc19392d759b4b7)

(From OE-Core rev: fdbcbb0fe92a862a993108609eb4107e34eeeed2)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko
2025-11-02 12:58:35 +01:00
committed by Steve Sakoman
parent ef4b31498d
commit ca2c8b88be
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.42.inc
View File

@@ -64,5 +64,6 @@ SRC_URI = "\
file://0026-CVE-2025-11081.patch \
file://0027-CVE-2025-8225.patch \
file://CVE-2025-11414.patch \
file://CVE-2025-11412.patch \
"
S = "${WORKDIR}/git"

35
meta/recipes-devtools/binutils/binutils/CVE-2025-11412.patch Normal file
View File

@@ -0,0 +1,35 @@
From 047435dd988a3975d40c6626a8f739a0b2e154bc Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Thu, 25 Sep 2025 08:22:24 +0930
Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry
Limit addends on vtentry relocs, otherwise ld might attempt to
allocate a stupidly large array. This also fixes the expression
overflow leading to pr33452. A vtable of 33M entries on a 64-bit
host is surely large enough, especially considering that VTINHERIT
and VTENTRY relocations are to support -fvtable-gc that disappeared
from gcc over 20 years ago.
PR ld/33452
* elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend.
CVE: CVE-2025-11412
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
bfd/elflink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/bfd/elflink.c b/bfd/elflink.c
index 54f0d6e957e..0a0456177c2 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -14613,7 +14613,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec,
const struct elf_backend_data *bed = get_elf_backend_data (abfd);
unsigned int log_file_align = bed->s->log_file_align;
- if (!h)
+ if (!h || addend > 1u << 28)
{
/* xgettext:c-format */
_bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),