CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-01 13:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

binutils: patch CVE-2025-11412

Browse Source 
Pick commit per NVD CVE report.

(From OE-Core rev: 6b94ff6c584a31d2b1e06d1e1dc19392d759b4b7)

(From OE-Core rev: 9130f3471f4814979cfdfa66ca118929f240cb30)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Peter Marko 2025-11-02 12:59:02 +01:00 committed by Steve Sakoman
parent d152607f64
commit aaf9219788
2 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.38.inc
View File

@ -84,5 +84,6 @@ SRC_URI = "\
file://0045-CVE-2025-11083.patch \
file://0046-CVE-2025-11081.patch \
file://0047-CVE-2025-8225.patch \
file://CVE-2025-11412.patch \
"
S = "${WORKDIR}/git"

35
meta/recipes-devtools/binutils/binutils/CVE-2025-11412.patch Normal file
View File

@ -0,0 +1,35 @@
From 047435dd988a3975d40c6626a8f739a0b2e154bc Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Thu, 25 Sep 2025 08:22:24 +0930
Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry
Limit addends on vtentry relocs, otherwise ld might attempt to
allocate a stupidly large array. This also fixes the expression
overflow leading to pr33452. A vtable of 33M entries on a 64-bit
host is surely large enough, especially considering that VTINHERIT
and VTENTRY relocations are to support -fvtable-gc that disappeared
from gcc over 20 years ago.
PR ld/33452
* elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend.
CVE: CVE-2025-11412
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=047435dd988a3975d40c6626a8f739a0b2e154bc]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
bfd/elflink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/bfd/elflink.c b/bfd/elflink.c
index 54f0d6e957e..0a0456177c2 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -14407,7 +14407,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec,
const struct elf_backend_data *bed = get_elf_backend_data (abfd);
unsigned int log_file_align = bed->s->log_file_align;
- if (!h)
+ if (!h || addend > 1u << 28)
{
/* xgettext:c-format */
_bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),