summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/binutils/binutils-2.42.inc2
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch151
-rw-r--r--meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch345
3 files changed, 498 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc
index d366350556..758bd8dcce 100644
--- a/meta/recipes-devtools/binutils/binutils-2.42.inc
+++ b/meta/recipes-devtools/binutils/binutils-2.42.inc
@@ -42,5 +42,7 @@ SRC_URI = "\
42 file://CVE-2025-1176.patch \ 42 file://CVE-2025-1176.patch \
43 file://CVE-2025-1178.patch \ 43 file://CVE-2025-1178.patch \
44 file://CVE-2024-57360.patch \ 44 file://CVE-2024-57360.patch \
45 file://CVE-2025-1181-pre.patch \
46 file://CVE-2025-1181.patch \
45" 47"
46S = "${WORKDIR}/git" 48S = "${WORKDIR}/git"
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch
new file mode 100644
index 0000000000..280e522a28
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch
@@ -0,0 +1,151 @@
1Backported of:
2
3From 18cc11a2771d9e40180485da9a4fb660c03efac3 Mon Sep 17 00:00:00 2001
4From: Nick Clifton <nickc@redhat.com>
5Date: Wed, 5 Feb 2025 14:31:10 +0000
6Subject: [PATCH] Prevent illegal memory access when checking relocs in a
7 corrupt ELF binary.
8
9PR 32641
10
11Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181-pre.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774]
12Upstream commit [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24]
13
14CVE: CVE-2025-1181
15
16Signed-off-by: Ashish Sharma <asharma@mvista.com>
17
18 bfd/elf-bfd.h | 3 +++
19 bfd/elf64-x86-64.c | 10 +++++-----
20 bfd/elflink.c | 24 ++++++++++++++++++++++++
21 bfd/elfxx-x86.c | 20 +++++++-------------
22 4 files changed, 39 insertions(+), 18 deletions(-)
23diff --git a/bfd/elf-bfd.h b/bfd/elf-bfd.h
24index 3ed22fa6..07add7d0 100644
25--- a/bfd/elf-bfd.h
26+++ b/bfd/elf-bfd.h
27@@ -3126,6 +3126,9 @@ extern bool _bfd_elf_maybe_set_textrel
28 extern bool _bfd_elf_add_dynamic_tags
29 (bfd *, struct bfd_link_info *, bool);
30
31+extern struct elf_link_hash_entry * _bfd_elf_get_link_hash_entry
32+ (struct elf_link_hash_entry **, unsigned int, Elf_Internal_Shdr *);
33+
34 /* Large common section. */
35 extern asection _bfd_elf_large_com_section;
36
37diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
38index d0d3b0e5..c3fb375c 100644
39--- a/bfd/elf64-x86-64.c
40+++ b/bfd/elf64-x86-64.c
41@@ -1665,7 +1665,7 @@ elf_x86_64_convert_load_reloc (bfd *abfd,
42 bool to_reloc_pc32;
43 bool abs_symbol;
44 bool local_ref;
45- asection *tsec;
46+ asection *tsec = NULL;
47 bfd_signed_vma raddend;
48 unsigned int opcode;
49 unsigned int modrm;
50@@ -1831,6 +1831,9 @@ elf_x86_64_convert_load_reloc (bfd *abfd,
51 return true;
52 }
53
54+ if (tsec == NULL)
55+ return false;
56+
57 /* Don't convert GOTPCREL relocation against large section. */
58 if (elf_section_data (tsec) != NULL
59 && (elf_section_flags (tsec) & SHF_X86_64_LARGE) != 0)
60@@ -2127,10 +2130,7 @@ elf_x86_64_scan_relocs (bfd *abfd, struct bfd_link_info *info,
61 else
62 {
63 isym = NULL;
64- h = sym_hashes[r_symndx - symtab_hdr->sh_info];
65- while (h->root.type == bfd_link_hash_indirect
66- || h->root.type == bfd_link_hash_warning)
67- h = (struct elf_link_hash_entry *) h->root.u.i.link;
68+ h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr);
69 }
70
71 /* Check invalid x32 relocations. */
72diff --git a/bfd/elflink.c b/bfd/elflink.c
73index 11ec6bd9..e5521d7b 100644
74--- a/bfd/elflink.c
75+++ b/bfd/elflink.c
76@@ -49,6 +49,27 @@ struct elf_info_failed
77 static bool _bfd_elf_fix_symbol_flags
78 (struct elf_link_hash_entry *, struct elf_info_failed *);
79
80+struct elf_link_hash_entry *
81+_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
82+ unsigned int symndx,
83+ Elf_Internal_Shdr * symtab_hdr)
84+{
85+ if (symndx < symtab_hdr->sh_info)
86+ return NULL;
87+
88+ struct elf_link_hash_entry *h = sym_hashes[symndx - symtab_hdr->sh_info];
89+
90+ /* The hash might be empty. See PR 32641 for an example of this. */
91+ if (h == NULL)
92+ return NULL;
93+
94+ while (h->root.type == bfd_link_hash_indirect
95+ || h->root.type == bfd_link_hash_warning)
96+ h = (struct elf_link_hash_entry *) h->root.u.i.link;
97+
98+ return h;
99+}
100+
101 static struct elf_link_hash_entry *
102 get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
103 {
104@@ -62,6 +83,9 @@ get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
105
106 h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
107
108+ if (h == NULL)
109+ return NULL;
110+
111 while (h->root.type == bfd_link_hash_indirect
112 || h->root.type == bfd_link_hash_warning)
113 h = (struct elf_link_hash_entry *) h->root.u.i.link;
114diff --git a/bfd/elfxx-x86.c b/bfd/elfxx-x86.c
115index 508fd771..8c261cf8 100644
116--- a/bfd/elfxx-x86.c
117+++ b/bfd/elfxx-x86.c
118@@ -972,15 +972,7 @@ _bfd_x86_elf_check_relocs (bfd *abfd,
119 goto error_return;
120 }
121
122- if (r_symndx < symtab_hdr->sh_info)
123- h = NULL;
124- else
125- {
126- h = sym_hashes[r_symndx - symtab_hdr->sh_info];
127- while (h->root.type == bfd_link_hash_indirect
128- || h->root.type == bfd_link_hash_warning)
129- h = (struct elf_link_hash_entry *) h->root.u.i.link;
130- }
131+ h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr);
132
133 if (X86_NEED_DYNAMIC_RELOC_TYPE_P (is_x86_64, r_type)
134 && NEED_DYNAMIC_RELOCATION_P (is_x86_64, info, true, h, sec,
135@@ -1205,10 +1197,12 @@ _bfd_x86_elf_link_relax_section (bfd *abfd ATTRIBUTE_UNUSED,
136 else
137 {
138 /* Get H and SEC for GENERATE_DYNAMIC_RELOCATION_P below. */
139- h = sym_hashes[r_symndx - symtab_hdr->sh_info];
140- while (h->root.type == bfd_link_hash_indirect
141- || h->root.type == bfd_link_hash_warning)
142- h = (struct elf_link_hash_entry *) h->root.u.i.link;
143+ h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr);
144+ if (h == NULL)
145+ {
146+ /* FIXMEL: Issue an error message ? */
147+ continue;
148+ }
149
150 if (h->root.type == bfd_link_hash_defined
151 || h->root.type == bfd_link_hash_defweak)
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch
new file mode 100644
index 0000000000..70b7485777
--- /dev/null
+++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch
@@ -0,0 +1,345 @@
1Backported of:
2
3From 931494c9a89558acb36a03a340c01726545eef24 Mon Sep 17 00:00:00 2001
4From: Nick Clifton <nickc@redhat.com>
5Date: Wed, 5 Feb 2025 15:43:04 +0000
6Subject: [PATCH] Add even more checks for corrupt input when processing
7 relocations for ELF files.
8
9PR 32643
10
11Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774]
12Upstream commit [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24]
13
14CVE: CVE-2025-1181
15
16Signed-off-by: Ashish Sharma <asharma@mvista.com>
17
18
19diff --git a/bfd/elflink.c b/bfd/elflink.c
20index e5521d7b..ff84229c 100644
21--- a/bfd/elflink.c
22+++ b/bfd/elflink.c
23@@ -49,15 +49,17 @@ struct elf_info_failed
24 static bool _bfd_elf_fix_symbol_flags
25 (struct elf_link_hash_entry *, struct elf_info_failed *);
26
27-struct elf_link_hash_entry *
28-_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
29- unsigned int symndx,
30- Elf_Internal_Shdr * symtab_hdr)
31+static struct elf_link_hash_entry *
32+get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
33+ unsigned int symndx,
34+ unsigned int ext_sym_start)
35 {
36- if (symndx < symtab_hdr->sh_info)
37+ if (sym_hashes == NULL
38+ /* Guard against corrupt input. See PR 32636 for an example. */
39+ || symndx < ext_sym_start)
40 return NULL;
41
42- struct elf_link_hash_entry *h = sym_hashes[symndx - symtab_hdr->sh_info];
43+ struct elf_link_hash_entry *h = sym_hashes[symndx - ext_sym_start];
44
45 /* The hash might be empty. See PR 32641 for an example of this. */
46 if (h == NULL)
47@@ -70,29 +72,28 @@ _bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
48 return h;
49 }
50
51-static struct elf_link_hash_entry *
52-get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
53+struct elf_link_hash_entry *
54+_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes,
55+ unsigned int symndx,
56+ Elf_Internal_Shdr * symtab_hdr)
57 {
58- struct elf_link_hash_entry *h = NULL;
59-
60- if ((r_symndx >= cookie->locsymcount
61- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
62- /* Guard against corrupt input. See PR 32636 for an example. */
63- && r_symndx >= cookie->extsymoff)
64- {
65-
66- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
67-
68- if (h == NULL)
69- return NULL;
70+ if (symtab_hdr == NULL)
71+ return NULL;
72
73- while (h->root.type == bfd_link_hash_indirect
74- || h->root.type == bfd_link_hash_warning)
75- h = (struct elf_link_hash_entry *) h->root.u.i.link;
76+ return get_link_hash_entry (sym_hashes, symndx, symtab_hdr->sh_info);
77+}
78
79- }
80+static struct elf_link_hash_entry *
81+get_ext_sym_hash_from_cookie (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
82+{
83+ if (cookie == NULL || cookie->sym_hashes == NULL)
84+ return NULL;
85+
86+ if (r_symndx >= cookie->locsymcount
87+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
88+ return get_link_hash_entry (cookie->sym_hashes, r_symndx, cookie->extsymoff);
89
90- return h;
91+ return NULL;
92 }
93
94 asection *
95@@ -102,7 +103,7 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
96 {
97 struct elf_link_hash_entry *h;
98
99- h = get_ext_sym_hash (cookie, r_symndx);
100+ h = get_ext_sym_hash_from_cookie (cookie, r_symndx);
101
102 if (h != NULL)
103 {
104@@ -8906,7 +8907,6 @@ set_symbol_value (bfd *bfd_with_globals,
105 size_t symidx,
106 bfd_vma val)
107 {
108- struct elf_link_hash_entry **sym_hashes;
109 struct elf_link_hash_entry *h;
110 size_t extsymoff = locsymcount;
111
112@@ -8929,12 +8929,12 @@ set_symbol_value (bfd *bfd_with_globals,
113
114 /* It is a global symbol: set its link type
115 to "defined" and give it a value. */
116-
117- sym_hashes = elf_sym_hashes (bfd_with_globals);
118- h = sym_hashes [symidx - extsymoff];
119- while (h->root.type == bfd_link_hash_indirect
120- || h->root.type == bfd_link_hash_warning)
121- h = (struct elf_link_hash_entry *) h->root.u.i.link;
122+ h = get_link_hash_entry (elf_sym_hashes (bfd_with_globals), symidx, extsymoff);
123+ if (h == NULL)
124+ {
125+ /* FIXMEL What should we do ? */
126+ return;
127+ }
128 h->root.type = bfd_link_hash_defined;
129 h->root.u.def.value = val;
130 h->root.u.def.section = bfd_abs_section_ptr;
131@@ -11405,10 +11405,19 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
132 || (elf_bad_symtab (input_bfd)
133 && flinfo->sections[symndx] == NULL))
134 {
135- struct elf_link_hash_entry *h = sym_hashes[symndx - extsymoff];
136- while (h->root.type == bfd_link_hash_indirect
137- || h->root.type == bfd_link_hash_warning)
138- h = (struct elf_link_hash_entry *) h->root.u.i.link;
139+ struct elf_link_hash_entry *h;
140+
141+ h = get_link_hash_entry (sym_hashes, symndx, extsymoff);
142+ if (h == NULL)
143+ {
144+ _bfd_error_handler
145+ /* xgettext:c-format */
146+ (_("error: %pB: unable to create group section symbol"),
147+ input_bfd);
148+ bfd_set_error (bfd_error_bad_value);
149+ return false;
150+ }
151+
152 /* Arrange for symbol to be output. */
153 h->indx = -2;
154 elf_section_data (osec)->this_hdr.sh_info = -2;
155@@ -11542,7 +11551,7 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
156 || (elf_bad_symtab (input_bfd)
157 && flinfo->sections[r_symndx] == NULL))
158 {
159- h = sym_hashes[r_symndx - extsymoff];
160+ h = get_link_hash_entry (sym_hashes, r_symndx, extsymoff);
161
162 /* Badly formatted input files can contain relocs that
163 reference non-existant symbols. Check here so that
164@@ -11551,17 +11560,13 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
165 {
166 _bfd_error_handler
167 /* xgettext:c-format */
168- (_("error: %pB contains a reloc (%#" PRIx64 ") for section %pA "
169+ (_("error: %pB contains a reloc (%#" PRIx64 ") for section '%pA' "
170 "that references a non-existent global symbol"),
171 input_bfd, (uint64_t) rel->r_info, o);
172 bfd_set_error (bfd_error_bad_value);
173 return false;
174 }
175
176- while (h->root.type == bfd_link_hash_indirect
177- || h->root.type == bfd_link_hash_warning)
178- h = (struct elf_link_hash_entry *) h->root.u.i.link;
179-
180 s_type = h->type;
181
182 /* If a plugin symbol is referenced from a non-IR file,
183@@ -11777,7 +11782,6 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
184 && flinfo->sections[r_symndx] == NULL))
185 {
186 struct elf_link_hash_entry *rh;
187- unsigned long indx;
188
189 /* This is a reloc against a global symbol. We
190 have not yet output all the local symbols, so
191@@ -11786,15 +11790,16 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
192 reloc to point to the global hash table entry
193 for this symbol. The symbol index is then
194 set at the end of bfd_elf_final_link. */
195- indx = r_symndx - extsymoff;
196- rh = elf_sym_hashes (input_bfd)[indx];
197- while (rh->root.type == bfd_link_hash_indirect
198- || rh->root.type == bfd_link_hash_warning)
199- rh = (struct elf_link_hash_entry *) rh->root.u.i.link;
200-
201- /* Setting the index to -2 tells
202- elf_link_output_extsym that this symbol is
203- used by a reloc. */
204+ rh = get_link_hash_entry (elf_sym_hashes (input_bfd),
205+ r_symndx, extsymoff);
206+ if (rh == NULL)
207+ {
208+ /* FIXME: Generate an error ? */
209+ continue;
210+ }
211+
212+ /* Setting the index to -2 tells elf_link_output_extsym
213+ that this symbol is used by a reloc. */
214 BFD_ASSERT (rh->indx < 0);
215 rh->indx = -2;
216 *rel_hash = rh;
217@@ -13758,25 +13763,21 @@ _bfd_elf_gc_mark_hook (asection *sec,
218 struct elf_link_hash_entry *h,
219 Elf_Internal_Sym *sym)
220 {
221- if (h != NULL)
222+ if (h == NULL)
223+ return bfd_section_from_elf_index (sec->owner, sym->st_shndx);
224+
225+ switch (h->root.type)
226 {
227- switch (h->root.type)
228- {
229- case bfd_link_hash_defined:
230- case bfd_link_hash_defweak:
231- return h->root.u.def.section;
232+ case bfd_link_hash_defined:
233+ case bfd_link_hash_defweak:
234+ return h->root.u.def.section;
235
236- case bfd_link_hash_common:
237- return h->root.u.c.p->section;
238+ case bfd_link_hash_common:
239+ return h->root.u.c.p->section;
240
241- default:
242- break;
243- }
244+ default:
245+ return NULL;
246 }
247- else
248- return bfd_section_from_elf_index (sec->owner, sym->st_shndx);
249-
250- return NULL;
251 }
252
253 /* Return the debug definition section. */
254@@ -13825,46 +13826,49 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
255 if (r_symndx == STN_UNDEF)
256 return NULL;
257
258- h = get_ext_sym_hash (cookie, r_symndx);
259-
260- if (h != NULL)
261+ h = get_ext_sym_hash_from_cookie (cookie, r_symndx);
262+ if (h == NULL)
263 {
264- bool was_marked;
265+ /* A corrup tinput file can lead to a situation where the index
266+ does not reference either a local or an external symbol. */
267+ if (r_symndx >= cookie->locsymcount)
268+ return NULL;
269
270- was_marked = h->mark;
271- h->mark = 1;
272- /* Keep all aliases of the symbol too. If an object symbol
273- needs to be copied into .dynbss then all of its aliases
274- should be present as dynamic symbols, not just the one used
275- on the copy relocation. */
276- hw = h;
277- while (hw->is_weakalias)
278- {
279- hw = hw->u.alias;
280- hw->mark = 1;
281- }
282+ return (*gc_mark_hook) (sec, info, cookie->rel, NULL,
283+ &cookie->locsyms[r_symndx]);
284+ }
285
286- if (!was_marked && h->start_stop && !h->root.ldscript_def)
287- {
288- if (info->start_stop_gc)
289- return NULL;
290+ bool was_marked = h->mark;
291
292- /* To work around a glibc bug, mark XXX input sections
293- when there is a reference to __start_XXX or __stop_XXX
294- symbols. */
295- else if (start_stop != NULL)
296- {
297- asection *s = h->u2.start_stop_section;
298- *start_stop = true;
299- return s;
300- }
301- }
302+ h->mark = 1;
303+ /* Keep all aliases of the symbol too. If an object symbol
304+ needs to be copied into .dynbss then all of its aliases
305+ should be present as dynamic symbols, not just the one used
306+ on the copy relocation. */
307+ hw = h;
308+ while (hw->is_weakalias)
309+ {
310+ hw = hw->u.alias;
311+ hw->mark = 1;
312+ }
313
314- return (*gc_mark_hook) (sec, info, cookie->rel, h, NULL);
315+ if (!was_marked && h->start_stop && !h->root.ldscript_def)
316+ {
317+ if (info->start_stop_gc)
318+ return NULL;
319+
320+ /* To work around a glibc bug, mark XXX input sections
321+ when there is a reference to __start_XXX or __stop_XXX
322+ symbols. */
323+ else if (start_stop != NULL)
324+ {
325+ asection *s = h->u2.start_stop_section;
326+ *start_stop = true;
327+ return s;
328+ }
329 }
330
331- return (*gc_mark_hook) (sec, info, cookie->rel, NULL,
332- &cookie->locsyms[r_symndx]);
333+ return (*gc_mark_hook) (sec, info, cookie->rel, h, NULL);
334 }
335
336 /* COOKIE->rel describes a relocation against section SEC, which is
337@@ -14878,7 +14882,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
338
339 struct elf_link_hash_entry *h;
340
341- h = get_ext_sym_hash (rcookie, r_symndx);
342+ h = get_ext_sym_hash_from_cookie (rcookie, r_symndx);
343
344 if (h != NULL)
345 {
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-15 05:10:37 +0000