1
0
mirror of https://git.yoctoproject.org/poky synced 2026-07-26 07:07:08 +00:00
Commit Graph

18 Commits

Author SHA1 Message Date
Peter Marko 6f906dc9cf binutils: patch CVE-2025-8225
Pick commit [1] mentioned in [2].

[1] https://gitlab.com/gnutools/binutils-gdb/-/commit/e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-8225

Testsuite did not show any changes in results:

 === binutils Summary ===

 # of expected passes           310
 # of unexpected failures       1
 # of untested testcases        1
 # of unsupported tests         9

(From OE-Core rev: 3d79514f90a6f731a5333417641500b8e52e410a)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-09-09 09:30:07 -07:00
Peter Marko c0192e2543 binutils: set status for CVE-2025-8224
Commit mentioned in CVE report is already included in current hash.
Can be verified by trying to cherry-pick.

(From OE-Core rev: c7297f46efa410a9204d3d386d307deada967bb6)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-08-29 10:02:59 -07:00
Harish Sadineni 5d2bdb56f8 binutils: Fix gprofng broken symbolic link with gp-*
In binutils 2.44, application names were changed from the gp- prefix
(e.g., gp-display-text, gp-archive) to the gprofng- prefix
(e.g., gprofng-display-text, gprofng-archive). Temporary gp-*
symlinks were added to maintain compatibility with the older
gprofng-gui.

However, these compatibility symlinks did not support cross-platform
toolchain prefixes, which resulted in broken gp-* symbolic links.

Support for cross-platform prefixes are added upstream in binutils 2.45,
so this change backports that fix to resolve broken symlinks issue.

Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=90803ffdcc4d8c3d17566bf8dccadbad312f07a9]

(From OE-Core rev: 55684a63904365d8a6ab2a8ce9e091f29b0b7df5)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-08-26 06:33:14 -07:00
Yash Shinde 2bc879a143 binutils: Fix CVE-2025-7546
Report corrupted group section instead of trying to recover.

CVE: CVE-2025-7546
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b]
PR  33050 [https://sourceware.org/bugzilla/show_bug.cgi?id=33050]

(From OE-Core rev: 2eea0b0132fd4bd4d66551a8cc6549480d8a29eb)

Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-07-21 09:18:00 -07:00
Deepesh Varatharajan b5cd1f7457 binutils: Fix CVE-2025-7545
objcopy: Don't extend the output section size
Since the output section contents are copied from the input, don't
extend the output section size beyond the input section size.

Backport a patch from upstream to fix CVE-2025-7545
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944]

(From OE-Core rev: 9730ddc98bd961d4e2b5b79fa60a2dde1d2a3301)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-07-21 09:18:00 -07:00
Deepesh Varatharajan 648f6d1fdd binutils: Fix CVE-2025-5245
PR32829, SEGV on objdump function debug_type_samep
u.kenum is always non-NULL, see debug_make_enum_type.

Backport a patch from upstream to fix CVE-2025-5245
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a]

(From OE-Core rev: ad946d34d1a4536b0431cb74ce29b47a0367b0ae)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-07-21 09:18:00 -07:00
Deepesh Varatharajan 16846fdc25 binutils: stable 2.44 branch updates
Below commits on binutils-2.44 stable branch are updated.

b09cf42d51e ld/PE: special-case relocation types only for COFF inputs
f0019390d12 s390: Prevent GOT access rewrite for misaligned symbols
452f5511154 x86: Check MODRM for call and jmp in binutils older than 2.45
4058d5a38a1 ld: fix C23 issue in vers7 test

Test Results:
                                 Before  After  Diff
No. of expected passes            310     310    0
No. of unexpected failures        1       1      0
No. of untested testcases         1       1      0
No. of unsupported tests          9       9      0

Testing was done and there were no regressions found

(From OE-Core rev: bf237c02ac3f49b367601063aba28c8d09cd8be8)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-07-21 09:18:00 -07:00
Harish Sadineni 6ed58415ba binutils: Fix for CVE-2025-3198
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d]
CVE: CVE-2025-3198

(From OE-Core rev: 3516188a077bd27e1de3bb42bd5630dba0b3b07f)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-20 09:21:26 -07:00
Deepesh Varatharajan 8119405fb0 binutils: Fix CVE-2025-5244
PR32858 ld segfault on fuzzed object
We missed one place where it is necessary to check for empty groups.

Backport a patch from upstream to fix CVE-2025-5244
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d1458933830456e54223d9fc61f0d9b3a19256f5]

(From OE-Core rev: 81e5831ea48e9d1e4b37e4ef6af11d382d7f1df8)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-13 09:01:26 -07:00
Deepesh Varatharajan dd4d53ffa1 binutils: Fix CVE-2025-1181
PR 32641 [https://sourceware.org/bugzilla/show_bug.cgi?id=32641]
PR 32643 [https://sourceware.org/bugzilla/show_bug.cgi?id=32643]

Upstream-Status: Backport
[https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=18cc11a2771d9e40180485da9a4fb660c03efac3
&& https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=931494c9a89558acb36a03a340c01726545eef24]

(From OE-Core rev: 8b9484767f49a558c442668ad9b8e86d6800819b)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-13 09:01:26 -07:00
Harish Sadineni cfe5f27c2a binutils: Fix CVE-2025-1182
Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141415.html]
CVE: CVE-2025-1182

(From OE-Core rev: 50ee37e89a04a3dd6b652831977171973791f6de)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-05 09:18:43 -07:00
Harish Sadineni fb4c310a65 binutils: Fix CVE-2025-1180
Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141351.html]
CVE: CVE-2025-1180

cherry picked from upstream commit:
https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814

(From OE-Core rev: d3c7b8e15a7be8238969f9eb010bde95a2b6c5ca)

Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Deepesh Varatharajan 9776909c9b binutils: Fix CVE-2025-1178
Prevent an abort in the bfd linker when attempting to
generate dynamic relocs for a corrupt input file.

PR 32638

Backport a patch from upstream to fix CVE-2025-1178
Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0]

(From OE-Core rev: 3325b9dfd7a0da2236c96630b67ac2c6d4375840)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko 717fb8a016 binutils: mark CVE-2025-1153 as fixed
We had this CVE patched but the patch was removed with last 2.44 branch
updates as it is now included.
Since there is no new version which could be set in NVD DB, this needs
to be explicitly handled.

(From OE-Core rev: 32f18145dee54f61203506daef339cd132908287)

(From OE-Core rev: b8ed40864e664e1cd50b2015569a406f49a0125e)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Peter Marko 64d92df698 binutils: drop obsolete CVE_STATUS
NVD has CVE-2023-25584 listed as < 2.40, so we don't need to ignore it
for version 2.44 anymore.

(From OE-Core rev: eaf80096f96e5bebed53076c1dfe7e35e539f383)

(From OE-Core rev: a0ffc4e44ba5e06eccf6d87fb16898454efcb1b2)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-02 10:26:30 -07:00
Deepesh Varatharajan f9ff1188df binutils: stable 2.44 branch updates
Below commits on binutils-2.44 stable branch are updated.

33578177adc dwarf: Dump .debug_loclists only for DWARF-5
fe459e33c67 PR 32603, revert message changes in 0b7f992b78fe and 31e9e2e8d109
37d12dd25d8 gdb/compile: add missing entry in bfd_link_callbacks array
31e9e2e8d10 PR 32603, more ld -w misbehaviour
0b7f992b78f PR 32603, ld -w misbehaviour
8cb98edf123 s390: Add support for z17 as CPU name
ed70d86b491 x86: Remove AVX10.2 256 bit rounding support
e1af7e590a5 elf: Clear the SEC_ALLOC bit for NOLOAD note sections
35db8c6dd2f ld: Pass -Wl,-z,lazy to compiler for i386 lazy binding tests
cc7ec316a45 Updated translations for bfd and gold
bf088ee09a7 PR 32731 ub sanitizer accessing filenames_reversed
78082591ec7 score-elf gas SEGV
d4c7ee9fbc1 gas: fix rs_fill_nop listing
a68d096a0ab Open the 2.44 branch for further development

Dropped: 0015-CVE-2025-1153.patch

Testing was done and there were no regressions found

(From OE-Core rev: e06b23897d51d075327012440afbabfe2d5a3de0)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-05-19 08:57:20 -07:00
Peter Marko 5f26d71861 binutils: patch CVE-2025-1153
Pick patch [1] mentioned in NVD report [2]

[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-1153

(From OE-Core rev: bc3c169d78dac9d2e83c533056b8bec8dbdab3f7)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-17 17:09:22 +00:00
Khem Raj 7c65f1da17 binutils: Upgrade to 2.44 release
* Drop the CVE-2024-53589 patch, its included in 2.44
* Package newly rename gp-* to gprofng-* binaries and remove old gp-*
  symlinks

* Gold linker is now deprecated and will be removed in future release
  its already deleted in tarball releases

* Support for the Nios II target has been removed.

* Assembler:
    - Support for new architecture extensions for AArch64, Risc-V and
      x86.

* Linker:
      The default maximum page size was changed from 16KiB to 64KiB for
      LoongArch.

      This now supports mixed LTO and non-LTO object files in
      relocatable output.

      The ELF forms of the linker support a --image-base=<ADDR> option
      for compatibility with LLD.

      The --build-id= option now accepts an argument of "xx" which
      enables the use of the xxhash library.  This produces a 128-bit
      hash and is 2-4x faster than md5 or sha1.

      The ELF linker option --package-metadata supports percent-encoded
      and %[string] encoded JSON payloads.

* Disassembler:
      The RISC-V disassembler now supports -M,max option like QEMU to
      dump instruction without checking architecture support as usual.

* GprofNG:
      Support added for hardware event counters for Neoverse-N1,
      Ampere-1, and Appliedmicro processors.

Detailed release notes [1]

[1] https://lists.gnu.org/archive/html/info-gnu/2025-02/msg00001.html

(From OE-Core rev: df3c43e69542939a4bec3893f1e927edf2ad7179)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-05 12:49:56 +00:00