CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

binutils: patch CVE-2025-11413

Browse Source 
Pick commit per NVD CVE report.

Note that there were two patches for this, first [1] and then [2].
The second patch moved the original patch to different location.
Cherry-pick of second patch is successful leaving out the code removing
the code from first location, so the patch attached here is not
identical to the upstream commit but is identical to applying both and
merging them to a single patch.

[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=1108620d7a521f1c85d2f629031ce0fbae14e331
[2] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0

(From OE-Core rev: 98df728e6136d04af0f4922b7ffbeffb704de395)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Peter Marko 2025-10-21 00:09:10 +02:00 committed by Richard Purdie
parent 52f475fd13
commit 5b2ea2b50e
2 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.45.inc
View File

@ -41,4 +41,5 @@ SRC_URI = "\
file://0017-CVE-2025-11083.patch \
file://CVE-2025-11414.patch \
file://CVE-2025-11412.patch \
file://CVE-2025-11413.patch \
"

38
meta/recipes-devtools/binutils/binutils/CVE-2025-11413.patch Normal file
View File

@ -0,0 +1,38 @@
From 72efdf166aa0ed72ecc69fc2349af6591a7a19c0 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Thu, 25 Sep 2025 10:41:32 +0930
Subject: [PATCH] Re: elf: Disallow the empty global symbol name
sparc64-linux-gnu +FAIL: selective2
sparc64-linux-gnu +FAIL: selective3
PR ld/33456
* elflink.c (elf_link_add_object_symbols): Move new check later
to give the backend add_symbol_hook a chance to remove symbols
with empty names.
CVE: CVE-2025-11413
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
bfd/elflink.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/bfd/elflink.c b/bfd/elflink.c
index 0a0456177c2..5c8b822e36a 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -5118,6 +5118,13 @@ elf_link_add_object_symbols (bfd *abfd, struct bfd_link_info *info)
continue;
}
+ if (name[0] == '\0')
+ {
+ _bfd_error_handler (_("%pB: corrupt symbol table"), abfd);
+ bfd_set_error (bfd_error_bad_value);
+ goto error_free_vers;
+ }
+
/* Sanity check that all possibilities were handled. */
if (sec == NULL)
abort ();