mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-01 02:30:13 +00:00
Code Issues Projects Releases Wiki Activity

binutils: fix CVE-2025-8224

Browse Source 
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-8224
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=db856d41004301b3a56438efd957ef5cabb91530

[Adapted for binutils 2.42: only the shstrtabsize overflow check in
bfd_elf_get_str_section applies. The second upstream hunk (DT_STRTAB)
does not apply as 2.42 already unconditionally null-terminates the
dynamic string table.]

Test results:
  binutils-cross-testsuite 2.42 (x86_64-oe-linux):

  Before:
  binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported
  gas:      1871 passed, 4 unexpected failures, 2 unsupported
  ld:       1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported

  After:
  binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported
  gas:      1871 passed, 4 unexpected failures, 2 unsupported
  ld:       1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=db856d41004301b3a56438efd957ef5cabb91530]
(From OE-Core rev: cadb858fcabe3fae57fc7efc5092c1574a50dd3a)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Jaipaul Cheernam
2026-08-28 09:52:24 +01:00
committed by Richard Purdie
parent e0d7b71bd7
commit d93c5f476f
2 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-devtools/binutils/binutils-2.42.inc
+1
View File
@@ -79,5 +79,6 @@ SRC_URI = "\
file://CVE-2026-6846.patch \
file://CVE-2025-69645.patch \
file://CVE-2025-1147.patch \
file://CVE-2025-8224.patch \
"
S = "${WORKDIR}/git"
meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch
+54
View File
@@ -0,0 +1,54 @@
From db856d41004301b3a56438efd957ef5cabb91530 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Sun, 25 Aug 2024 15:20:21 +0930
Subject: [PATCH] PR32109, aborting at bfd/bfd.c:1236 in int _bfd_doprnt
Since bfd_section for .strtab isn't set, print the section index
instead. Also, don't return NULL on this error as that results in
multiple mmap/read of the string table. (We could return NULL if we
arranged to set sh_size zero first, but just what we do with fuzzed
object files is of no concern, and terminating the table might make a
faulty object file usable.)
PR 32109
* elf.c (bfd_elf_get_str_section): Remove outdated comment, and
tweak shstrtabsize test to suit. Don't use string tab bfd_section
in error message, use index instead. Don't return NULL on
unterminated string section, terminate it.
(_bfd_elf_get_dynamic_symbols): Similarly terminate string table
section.
[Backport note: Adapted for binutils 2.42. The upstream commit targets
a newer codebase that uses _bfd_mmap_readonly_persistent and has an
explicit unterminated-string error path with return NULL. In 2.42 the
code uses _bfd_alloc_and_read with shstrtabsize+1 allocation and
unconditionally null-terminates via shstrtab[shstrtabsize] = '\0'.
Only the shstrtabsize overflow check fix applies here (shstrtabsize + 1 <= 1
changed to shstrtabsize == 0). The second upstream hunk (DT_STRTAB
error_return -> terminate) does not apply as 2.42 already
unconditionally null-terminates the dynamic string table.]
CVE: CVE-2025-8224
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=db856d41004301b3a56438efd957ef5cabb91530]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
bfd/elf.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/bfd/elf.c b/bfd/elf.c
--- a/bfd/elf.c
+++ b/bfd/elf.c
@@ -285,9 +285,7 @@ bfd_elf_get_str_section (bfd *abfd, unsigned int shindex)
offset = i_shdrp[shindex]->sh_offset;
shstrtabsize = i_shdrp[shindex]->sh_size;
- /* Allocate and clear an extra byte at the end, to prevent crashes
- in case the string table is not terminated. */
- if (shstrtabsize + 1 <= 1
+ if (shstrtabsize == 0
|| bfd_seek (abfd, offset, SEEK_SET) != 0
|| (shstrtab = _bfd_alloc_and_read (abfd, shstrtabsize + 1,
shstrtabsize)) == NULL)
--
2.43.7