summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/binutils/binutils-2.38.inc2
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch149
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch342
3 files changed, 493 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc
index d268880409..36f9c7ce27 100644
--- a/meta/recipes-devtools/binutils/binutils-2.38.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.38.inc
@@ -89,5 +89,7 @@ SRC_URI = "\
89 file://0048-CVE-2025-11494.patch \ 89 file://0048-CVE-2025-11494.patch \
90 file://0049-CVE-2025-11839.patch \ 90 file://0049-CVE-2025-11839.patch \
91 file://0050-CVE-2025-11840.patch \ 91 file://0050-CVE-2025-11840.patch \
92 file://CVE-2025-1181-pre.patch \
93 file://CVE-2025-1181.patch \
92" 94"
93S = "${WORKDIR}/git" 95S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch
new file mode 100644
index 0000000000..ffad871657
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch
@@ -0,0 +1,149 @@
1Backported of:
2
3From 18cc11a2771d9e40180485da9a4fb660c03efac3 Mon Sep 17 00:00:00 2001
4From: Nick Clifton <nickc@redhat.com>
5Date: Wed, 5 Feb 2025 14:31:10 +0000
6Subject: [PATCH] Prevent illegal memory access when checking relocs in a
7 corrupt ELF binary.
8
9PR 32641
10
11Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/tree/debian/patches/CVE-2025-1181-pre.patch?h=ubuntu/jammy-security
12Upstream commit https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=18cc11a2771d9e40180485da9a4fb660c03efac3]
13CVE: CVE-2025-1181
14Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
15---
16 bfd/elf-bfd.h | 3 +++
17 bfd/elf64-x86-64.c | 10 +++++-----
18 bfd/elflink.c | 24 ++++++++++++++++++++++++
19 bfd/elfxx-x86.c | 20 +++++++-------------
20 4 files changed, 39 insertions(+), 18 deletions(-)
21Index: binutils-2.38/bfd/elf-bfd.h
22===================================================================
23--- binutils-2.38.orig/bfd/elf-bfd.h
24+++ binutils-2.38/bfd/elf-bfd.h
25@@ -3007,6 +3007,9 @@ extern bool _bfd_elf_maybe_set_textrel
26 extern bool _bfd_elf_add_dynamic_tags
27 (bfd *, struct bfd_link_info *, bool);
28
29+extern struct elf_link_hash_entry * _bfd_elf_get_link_hash_entry
30+ (struct elf_link_hash_entry **, unsigned int, Elf_Internal_Shdr *);
31+
32 /* Large common section. */
33 extern asection _bfd_elf_large_com_section;
34
35Index: binutils-2.38/bfd/elf64-x86-64.c
36===================================================================
37--- binutils-2.38.orig/bfd/elf64-x86-64.c
38+++ binutils-2.38/bfd/elf64-x86-64.c
39@@ -1484,7 +1484,7 @@ elf_x86_64_convert_load_reloc (bfd *abfd
40 bool to_reloc_pc32;
41 bool abs_symbol;
42 bool local_ref;
43- asection *tsec;
44+ asection *tsec = NULL;
45 bfd_signed_vma raddend;
46 unsigned int opcode;
47 unsigned int modrm;
48@@ -1639,6 +1639,9 @@ elf_x86_64_convert_load_reloc (bfd *abfd
49 return true;
50 }
51
52+ if (tsec == NULL)
53+ return false;
54+
55 /* Don't convert GOTPCREL relocation against large section. */
56 if (elf_section_data (tsec) != NULL
57 && (elf_section_flags (tsec) & SHF_X86_64_LARGE) != 0)
58@@ -1915,10 +1918,7 @@ elf_x86_64_scan_relocs (bfd *abfd, struc
59 else
60 {
61 isym = NULL;
62- h = sym_hashes[r_symndx - symtab_hdr->sh_info];
63- while (h->root.type == bfd_link_hash_indirect
64- || h->root.type == bfd_link_hash_warning)
65- h = (struct elf_link_hash_entry *) h->root.u.i.link;
66+ h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr);
67 }
68
69 /* Check invalid x32 relocations. */
70Index: binutils-2.38/bfd/elflink.c
71===================================================================
72--- binutils-2.38.orig/bfd/elflink.c
73+++ binutils-2.38/bfd/elflink.c
74@@ -62,6 +62,27 @@ struct elf_find_verdep_info
75 static bool _bfd_elf_fix_symbol_flags
76 (struct elf_link_hash_entry *, struct elf_info_failed *);
77
78+struct elf_link_hash_entry *
79+_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
80+ unsigned int symndx,
81+ Elf_Internal_Shdr * symtab_hdr)
82+{
83+ if (symndx < symtab_hdr->sh_info)
84+ return NULL;
85+
86+ struct elf_link_hash_entry *h = sym_hashes[symndx - symtab_hdr->sh_info];
87+
88+ /* The hash might be empty. See PR 32641 for an example of this. */
89+ if (h == NULL)
90+ return NULL;
91+
92+ while (h->root.type == bfd_link_hash_indirect
93+ || h->root.type == bfd_link_hash_warning)
94+ h = (struct elf_link_hash_entry *) h->root.u.i.link;
95+
96+ return h;
97+}
98+
99 static struct elf_link_hash_entry *
100 get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
101 {
102@@ -75,6 +96,9 @@ get_ext_sym_hash (struct elf_reloc_cooki
103
104 h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
105
106+ if (h == NULL)
107+ return NULL;
108+
109 while (h->root.type == bfd_link_hash_indirect
110 || h->root.type == bfd_link_hash_warning)
111 h = (struct elf_link_hash_entry *) h->root.u.i.link;
112Index: binutils-2.38/bfd/elfxx-x86.c
113===================================================================
114--- binutils-2.38.orig/bfd/elfxx-x86.c
115+++ binutils-2.38/bfd/elfxx-x86.c
116@@ -973,15 +973,7 @@ _bfd_x86_elf_check_relocs (bfd *abfd,
117 goto error_return;
118 }
119
120- if (r_symndx < symtab_hdr->sh_info)
121- h = NULL;
122- else
123- {
124- h = sym_hashes[r_symndx - symtab_hdr->sh_info];
125- while (h->root.type == bfd_link_hash_indirect
126- || h->root.type == bfd_link_hash_warning)
127- h = (struct elf_link_hash_entry *) h->root.u.i.link;
128- }
129+ h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr);
130
131 if (X86_NEED_DYNAMIC_RELOC_TYPE_P (is_x86_64, r_type)
132 && NEED_DYNAMIC_RELOCATION_P (is_x86_64, info, true, h, sec,
133@@ -1200,10 +1192,12 @@ _bfd_x86_elf_link_relax_section (bfd *ab
134 else
135 {
136 /* Get H and SEC for GENERATE_DYNAMIC_RELOCATION_P below. */
137- h = sym_hashes[r_symndx - symtab_hdr->sh_info];
138- while (h->root.type == bfd_link_hash_indirect
139- || h->root.type == bfd_link_hash_warning)
140- h = (struct elf_link_hash_entry *) h->root.u.i.link;
141+ h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr);
142+ if (h == NULL)
143+ {
144+ /* FIXMEL: Issue an error message ? */
145+ continue;
146+ }
147
148 if (h->root.type == bfd_link_hash_defined
149 || h->root.type == bfd_link_hash_defweak)
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch
new file mode 100644
index 0000000000..2bcd55795d
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch
@@ -0,0 +1,342 @@
1Backported of:
2
3From 931494c9a89558acb36a03a340c01726545eef24 Mon Sep 17 00:00:00 2001
4From: Nick Clifton <nickc@redhat.com>
5Date: Wed, 5 Feb 2025 15:43:04 +0000
6Subject: [PATCH] Add even more checks for corrupt input when processing
7 relocations for ELF files.
8
9PR 32643
10
11Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/tree/debian/patches/CVE-2025-1181.patch?h=ubuntu/jammy-security
12Upstream commit https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24]
13CVE: CVE-2025-1181
14Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
15
16Index: binutils-2.38/bfd/elflink.c
17===================================================================
18--- binutils-2.38.orig/bfd/elflink.c
19+++ binutils-2.38/bfd/elflink.c
20@@ -62,15 +62,17 @@ struct elf_find_verdep_info
21 static bool _bfd_elf_fix_symbol_flags
22 (struct elf_link_hash_entry *, struct elf_info_failed *);
23
24-struct elf_link_hash_entry *
25-_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
26- unsigned int symndx,
27- Elf_Internal_Shdr * symtab_hdr)
28+static struct elf_link_hash_entry *
29+get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
30+ unsigned int symndx,
31+ unsigned int ext_sym_start)
32 {
33- if (symndx < symtab_hdr->sh_info)
34+ if (sym_hashes == NULL
35+ /* Guard against corrupt input. See PR 32636 for an example. */
36+ || symndx < ext_sym_start)
37 return NULL;
38
39- struct elf_link_hash_entry *h = sym_hashes[symndx - symtab_hdr->sh_info];
40+ struct elf_link_hash_entry *h = sym_hashes[symndx - ext_sym_start];
41
42 /* The hash might be empty. See PR 32641 for an example of this. */
43 if (h == NULL)
44@@ -83,29 +85,28 @@ _bfd_elf_get_link_hash_entry (struct elf
45 return h;
46 }
47
48-static struct elf_link_hash_entry *
49-get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
50+struct elf_link_hash_entry *
51+_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
52+ unsigned int symndx,
53+ Elf_Internal_Shdr * symtab_hdr)
54 {
55- struct elf_link_hash_entry *h = NULL;
56-
57- if ((r_symndx >= cookie->locsymcount
58- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
59- /* Guard against corrupt input. See PR 32636 for an example. */
60- && r_symndx >= cookie->extsymoff)
61- {
62-
63- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
64-
65- if (h == NULL)
66- return NULL;
67+ if (symtab_hdr == NULL)
68+ return NULL;
69
70- while (h->root.type == bfd_link_hash_indirect
71- || h->root.type == bfd_link_hash_warning)
72- h = (struct elf_link_hash_entry *) h->root.u.i.link;
73+ return get_link_hash_entry (sym_hashes, symndx, symtab_hdr->sh_info);
74+}
75
76- }
77+static struct elf_link_hash_entry *
78+get_ext_sym_hash_from_cookie (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
79+{
80+ if (cookie == NULL || cookie->sym_hashes == NULL)
81+ return NULL;
82+
83+ if (r_symndx >= cookie->locsymcount
84+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
85+ return get_link_hash_entry (cookie->sym_hashes, r_symndx, cookie->extsymoff);
86
87- return h;
88+ return NULL;
89 }
90
91 asection *
92@@ -115,7 +116,7 @@ _bfd_elf_section_for_symbol (struct elf_
93 {
94 struct elf_link_hash_entry *h;
95
96- h = get_ext_sym_hash (cookie, r_symndx);
97+ h = get_ext_sym_hash_from_cookie (cookie, r_symndx);
98
99 if (h != NULL)
100 {
101@@ -8783,7 +8784,6 @@ set_symbol_value (bfd *bfd_with_globals,
102 size_t symidx,
103 bfd_vma val)
104 {
105- struct elf_link_hash_entry **sym_hashes;
106 struct elf_link_hash_entry *h;
107 size_t extsymoff = locsymcount;
108
109@@ -8806,12 +8806,12 @@ set_symbol_value (bfd *bfd_with_globals,
110
111 /* It is a global symbol: set its link type
112 to "defined" and give it a value. */
113-
114- sym_hashes = elf_sym_hashes (bfd_with_globals);
115- h = sym_hashes [symidx - extsymoff];
116- while (h->root.type == bfd_link_hash_indirect
117- || h->root.type == bfd_link_hash_warning)
118- h = (struct elf_link_hash_entry *) h->root.u.i.link;
119+ h = get_link_hash_entry (elf_sym_hashes (bfd_with_globals), symidx, extsymoff);
120+ if (h == NULL)
121+ {
122+ /* FIXMEL What should we do ? */
123+ return;
124+ }
125 h->root.type = bfd_link_hash_defined;
126 h->root.u.def.value = val;
127 h->root.u.def.section = bfd_abs_section_ptr;
128@@ -11281,10 +11281,19 @@ elf_link_input_bfd (struct elf_final_lin
129 || (elf_bad_symtab (input_bfd)
130 && flinfo->sections[symndx] == NULL))
131 {
132- struct elf_link_hash_entry *h = sym_hashes[symndx - extsymoff];
133- while (h->root.type == bfd_link_hash_indirect
134- || h->root.type == bfd_link_hash_warning)
135- h = (struct elf_link_hash_entry *) h->root.u.i.link;
136+ struct elf_link_hash_entry *h;
137+
138+ h = get_link_hash_entry (sym_hashes, symndx, extsymoff);
139+ if (h == NULL)
140+ {
141+ _bfd_error_handler
142+ /* xgettext:c-format */
143+ (_("error: %pB: unable to create group section symbol"),
144+ input_bfd);
145+ bfd_set_error (bfd_error_bad_value);
146+ return false;
147+ }
148+
149 /* Arrange for symbol to be output. */
150 h->indx = -2;
151 elf_section_data (osec)->this_hdr.sh_info = -2;
152@@ -11411,7 +11420,7 @@ elf_link_input_bfd (struct elf_final_lin
153 || (elf_bad_symtab (input_bfd)
154 && flinfo->sections[r_symndx] == NULL))
155 {
156- h = sym_hashes[r_symndx - extsymoff];
157+ h = get_link_hash_entry (sym_hashes, r_symndx, extsymoff);
158
159 /* Badly formatted input files can contain relocs that
160 reference non-existant symbols. Check here so that
161@@ -11420,17 +11429,13 @@ elf_link_input_bfd (struct elf_final_lin
162 {
163 _bfd_error_handler
164 /* xgettext:c-format */
165- (_("error: %pB contains a reloc (%#" PRIx64 ") for section %pA "
166+ (_("error: %pB contains a reloc (%#" PRIx64 ") for section '%pA' "
167 "that references a non-existent global symbol"),
168 input_bfd, (uint64_t) rel->r_info, o);
169 bfd_set_error (bfd_error_bad_value);
170 return false;
171 }
172
173- while (h->root.type == bfd_link_hash_indirect
174- || h->root.type == bfd_link_hash_warning)
175- h = (struct elf_link_hash_entry *) h->root.u.i.link;
176-
177 s_type = h->type;
178
179 /* If a plugin symbol is referenced from a non-IR file,
180@@ -11646,7 +11651,6 @@ elf_link_input_bfd (struct elf_final_lin
181 && flinfo->sections[r_symndx] == NULL))
182 {
183 struct elf_link_hash_entry *rh;
184- unsigned long indx;
185
186 /* This is a reloc against a global symbol. We
187 have not yet output all the local symbols, so
188@@ -11655,15 +11659,16 @@ elf_link_input_bfd (struct elf_final_lin
189 reloc to point to the global hash table entry
190 for this symbol. The symbol index is then
191 set at the end of bfd_elf_final_link. */
192- indx = r_symndx - extsymoff;
193- rh = elf_sym_hashes (input_bfd)[indx];
194- while (rh->root.type == bfd_link_hash_indirect
195- || rh->root.type == bfd_link_hash_warning)
196- rh = (struct elf_link_hash_entry *) rh->root.u.i.link;
197-
198- /* Setting the index to -2 tells
199- elf_link_output_extsym that this symbol is
200- used by a reloc. */
201+ rh = get_link_hash_entry (elf_sym_hashes (input_bfd),
202+ r_symndx, extsymoff);
203+ if (rh == NULL)
204+ {
205+ /* FIXME: Generate an error ? */
206+ continue;
207+ }
208+
209+ /* Setting the index to -2 tells elf_link_output_extsym
210+ that this symbol is used by a reloc. */
211 BFD_ASSERT (rh->indx < 0);
212 rh->indx = -2;
213 *rel_hash = rh;
214@@ -13615,25 +13620,21 @@ _bfd_elf_gc_mark_hook (asection *sec,
215 struct elf_link_hash_entry *h,
216 Elf_Internal_Sym *sym)
217 {
218- if (h != NULL)
219+ if (h == NULL)
220+ return bfd_section_from_elf_index (sec->owner, sym->st_shndx);
221+
222+ switch (h->root.type)
223 {
224- switch (h->root.type)
225- {
226- case bfd_link_hash_defined:
227- case bfd_link_hash_defweak:
228- return h->root.u.def.section;
229+ case bfd_link_hash_defined:
230+ case bfd_link_hash_defweak:
231+ return h->root.u.def.section;
232
233- case bfd_link_hash_common:
234- return h->root.u.c.p->section;
235+ case bfd_link_hash_common:
236+ return h->root.u.c.p->section;
237
238- default:
239- break;
240- }
241+ default:
242+ return NULL;
243 }
244- else
245- return bfd_section_from_elf_index (sec->owner, sym->st_shndx);
246-
247- return NULL;
248 }
249
250 /* Return the debug definition section. */
251@@ -13682,46 +13683,49 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_i
252 if (r_symndx == STN_UNDEF)
253 return NULL;
254
255- h = get_ext_sym_hash (cookie, r_symndx);
256-
257- if (h != NULL)
258+ h = get_ext_sym_hash_from_cookie (cookie, r_symndx);
259+ if (h == NULL)
260 {
261- bool was_marked;
262+ /* A corrup tinput file can lead to a situation where the index
263+ does not reference either a local or an external symbol. */
264+ if (r_symndx >= cookie->locsymcount)
265+ return NULL;
266
267- was_marked = h->mark;
268- h->mark = 1;
269- /* Keep all aliases of the symbol too. If an object symbol
270- needs to be copied into .dynbss then all of its aliases
271- should be present as dynamic symbols, not just the one used
272- on the copy relocation. */
273- hw = h;
274- while (hw->is_weakalias)
275- {
276- hw = hw->u.alias;
277- hw->mark = 1;
278- }
279+ return (*gc_mark_hook) (sec, info, cookie->rel, NULL,
280+ &cookie->locsyms[r_symndx]);
281+ }
282
283- if (!was_marked && h->start_stop && !h->root.ldscript_def)
284- {
285- if (info->start_stop_gc)
286- return NULL;
287+ bool was_marked = h->mark;
288
289- /* To work around a glibc bug, mark XXX input sections
290- when there is a reference to __start_XXX or __stop_XXX
291- symbols. */
292- else if (start_stop != NULL)
293- {
294- asection *s = h->u2.start_stop_section;
295- *start_stop = true;
296- return s;
297- }
298- }
299+ h->mark = 1;
300+ /* Keep all aliases of the symbol too. If an object symbol
301+ needs to be copied into .dynbss then all of its aliases
302+ should be present as dynamic symbols, not just the one used
303+ on the copy relocation. */
304+ hw = h;
305+ while (hw->is_weakalias)
306+ {
307+ hw = hw->u.alias;
308+ hw->mark = 1;
309+ }
310
311- return (*gc_mark_hook) (sec, info, cookie->rel, h, NULL);
312+ if (!was_marked && h->start_stop && !h->root.ldscript_def)
313+ {
314+ if (info->start_stop_gc)
315+ return NULL;
316+
317+ /* To work around a glibc bug, mark XXX input sections
318+ when there is a reference to __start_XXX or __stop_XXX
319+ symbols. */
320+ else if (start_stop != NULL)
321+ {
322+ asection *s = h->u2.start_stop_section;
323+ *start_stop = true;
324+ return s;
325+ }
326 }
327
328- return (*gc_mark_hook) (sec, info, cookie->rel, NULL,
329- &cookie->locsyms[r_symndx]);
330+ return (*gc_mark_hook) (sec, info, cookie->rel, h, NULL);
331 }
332
333 /* COOKIE->rel describes a relocation against section SEC, which is
334@@ -14735,7 +14739,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma
335
336 struct elf_link_hash_entry *h;
337
338- h = get_ext_sym_hash (rcookie, r_symndx);
339+ h = get_ext_sym_hash_from_cookie (rcookie, r_symndx);
340
341 if (h != NULL)
342 {
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-09-09 12:02:43 +0000