Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-4.0.30 2025-08-04T13:40:00+00:00 2025-08-04T13:40:00+00:00 Deepesh Varatharajan Deepesh.Varatharajan@windriver.com 2025-07-29T09:15:32+00:00 urn:sha1:31dd8d47a6ce0f4298e92e537b7cf836a093dfab objcopy: Don't extend the output section size Since the output section contents are copied from the input, don't extend the output section size beyond the input section size. Backport a patch from upstream to fix CVE-2025-7545 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944] (From OE-Core rev: 4f461ed46b7694fc4815c7f0504b9cefe5da8e19) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-07-30T14:47:48+00:00 Yash Shinde Yash.Shinde@windriver.com 2025-07-17T12:02:10+00:00 urn:sha1:47c3b0bc3f2088710f0260702babac05cf6b69ab Report corrupted group section instead of trying to recover. CVE: CVE-2025-7546 Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b] PR 33050 [https://sourceware.org/bugzilla/show_bug.cgi?id=33050] (From OE-Core rev: 5860b954681c37ac6685631cce439fd349093689) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-07-18T15:32:26+00:00 Deepesh Varatharajan Deepesh.Varatharajan@windriver.com 2025-07-15T07:47:04+00:00 urn:sha1:9b3bd34826f0fe3d532e16881cc026b04c67bd3b Below commit on binutils-2.38 stable branch are updated. 9bee8d65d32 x86: Check MODRM for call and jmp in binutils older than 2.45 Before After Diff No. of expected passes 280 280 0 No. of unexpected failures 2 2 0 No. of untested testcases 1 1 0 No. of unsupported tests 7 7 0 Testing was done and there were no regressions found (From OE-Core rev: 7ac807166dfb6723f4e0b53c21f434e21d25563e) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-06-13T15:42:35+00:00 Deepesh Varatharajan Deepesh.Varatharajan@windriver.com 2025-06-09T04:48:49+00:00 urn:sha1:c6848d874c2f49e9b9aead0dbac475dedd8a1492 PR32858 ld segfault on fuzzed object We missed one place where it is necessary to check for empty groups. PR32829, SEGV on objdump function debug_type_samep u.kenum is always non-NULL, see debug_make_enum_type. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d1458933830456e54223d9fc61f0d9b3a19256f5] && [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=6c3458a8b7ee7d39f070c7b2350851cb2110c65a] (From OE-Core rev: 7eb29f802b272dec19c5bfdce93155d99bac918d) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-06-13T15:42:35+00:00 Harish Sadineni Harish.Sadineni@windriver.com 2025-06-05T09:03:14+00:00 urn:sha1:775ca31829595a1931cc3a392e9827f20335f618 Forgot to add CVE-2025-1182 patch file to SRC_URI in the following commit https://lists.openembedded.org/g/openembedded-core/message/217350 After rebasing the CVE-2025-1180.patch, we encountered hunk errors while applying the CVE-2025-1182.patch, so I have modified the patch accordingly. (From OE-Core rev: 131f93b8efcddac984965a250b5391c43ca54ac8) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-06-04T16:06:31+00:00 Harish Sadineni Harish.Sadineni@windriver.com 2025-05-29T12:12:02+00:00 urn:sha1:6fceeca06718b8a84528ae86f406460a8d712a56 Backporting the fix from PR 32636 to fix PR 32642 (ld SEGV (illegal read access) in _bfd_elf_write_section_eh_frame (bfd/elf-eh-frame.c:2234:29) with --gc-sections --gc-keep-exported option) https://nvd.nist.gov/vuln/detail/CVE-2025-1180 is associated with PR32642 which will get fixed with commit from PR 32636. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814] CVE: CVE-2025-1180 (From OE-Core rev: 8178f44f18777b2c8acc0afb9fd43921a9a8e76e) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-06-04T16:06:31+00:00 Harish Sadineni Harish.Sadineni@windriver.com 2025-05-28T14:15:47+00:00 urn:sha1:94dea33c75f818c1424dc24366a3e3f368a208fe Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=b425859021d17adf62f06fb904797cf8642986ad] CVE: CVE-2025-1182 (From OE-Core rev: bbfdd5c44a5629b9158b418b5335ec4f1567b3f9) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-05-02T15:12:41+00:00 Deepesh Varatharajan Deepesh.Varatharajan@windriver.com 2025-04-28T09:41:11+00:00 urn:sha1:520ba611e6b5bfb592d2e57032493ac9dd57ccaf Prevent an abort in the bfd linker when attempting to generate dynamic relocs for a corrupt input file. PR 32638 Backport a patch from upstream to fix CVE-2025-1178 Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0] (From OE-Core rev: e820e5364c4b3ec52796a77842b480fea8bc7967) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-03-13T15:50:03+00:00 Deepesh Varatharajan Deepesh.Varatharajan@windriver.com 2025-03-06T10:48:06+00:00 urn:sha1:e9f1ad69225a1cdd74628fbfd64135b55da96f51 PR32560 stack-buffer-overflow at objdump disassemble_bytes Backport a patch from upstream to fix CVE-2025-0840 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893] (From OE-Core rev: e12ee4b1713aa25465aa3f866d345d84e9eb948a) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-02-05T14:54:35+00:00 Yash Shinde Yash.Shinde@windriver.com 2025-01-30T11:33:33+00:00 urn:sha1:7e19a678138ab7dd7fcfe92c700c36674f347b82 CVE: CVE-2024-53589 (From OE-Core rev: 2d6df18f4a694d6499b337bbbab10ba8bb6e3fe4) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>