| Message ID | 20260406070506.3779367-1-Harish.Sadineni@windriver.com |
|---|---|
| State | New |
| Headers | show |
| Series | binutils: Set status for CVE-2025-69646 & CVE-2025-69649 | expand |
On Mon, 2026-04-06 at 00:05 -0700, Sadineni, Harish via lists.openembedded.org wrote: > From: Harish Sadineni <Harish.Sadineni@windriver.com> > > Set CVE_STATUS for CVE-2025-69646 and CVE-2025-69649, as both CVES are already resolved > in the latest binutils 2.46 version upgrade. > > Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> > --- > meta/recipes-devtools/binutils/binutils-2.46.inc | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.46.inc > index ff10050dd9..dc8b6be03e 100644 > --- a/meta/recipes-devtools/binutils/binutils-2.46.inc > +++ b/meta/recipes-devtools/binutils/binutils-2.46.inc > @@ -34,3 +34,6 @@ SRC_URI = "\ > file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \ > file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \ > " > + > +CVE_STATUS[CVE-2025-69646] = "fixed-version: Fixed from version 2.46" Hi Harish, According to https://nvd.nist.gov/vuln/detail/CVE-2025-69646, the CPE for CVE-2025-69646 is "cpe:2.3:a:gnu:binutils:2.44:*:*:*:*:*:*:*", so it should already be seen as fixed in 2.46. Which tool is reporting this as an unresolved CVE? > +CVE_STATUS[CVE-2025-69649] = "fixed-version: Fixed from version 2.46" According to https://nvd.nist.gov/vuln/detail/CVE-2025-69649, the CPE for this one is "cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*". Please include some info/links in the commit message to confirm that this was fixed for v2.46. Best regards,
On 4/6/2026 1:58 PM, Paul Barker wrote: > On Mon, 2026-04-06 at 00:05 -0700, Sadineni, Harish via > lists.openembedded.org wrote: >> From: Harish Sadineni <Harish.Sadineni@windriver.com> >> >> Set CVE_STATUS for CVE-2025-69646 and CVE-2025-69649, as both CVES are already resolved >> in the latest binutils 2.46 version upgrade. >> >> Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> >> --- >> meta/recipes-devtools/binutils/binutils-2.46.inc | 3 +++ >> 1 file changed, 3 insertions(+) >> >> diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.46.inc >> index ff10050dd9..dc8b6be03e 100644 >> --- a/meta/recipes-devtools/binutils/binutils-2.46.inc >> +++ b/meta/recipes-devtools/binutils/binutils-2.46.inc >> @@ -34,3 +34,6 @@ SRC_URI = "\ >> file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \ >> file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \ >> " >> + >> +CVE_STATUS[CVE-2025-69646] = "fixed-version: Fixed from version 2.46" > Hi Harish, > > According to https://nvd.nist.gov/vuln/detail/CVE-2025-69646, the CPE > for CVE-2025-69646 is "cpe:2.3:a:gnu:binutils:2.44:*:*:*:*:*:*:*", so it > should already be seen as fixed in 2.46. Which tool is reporting this as > an unresolved CVE? git branch -a --contains 598704a00cbac5e85c2bedd363357b5bf6fcee33 * master remotes/origin/HEAD -> origin/master remotes/origin/binutils-2_46-branch remotes/origin/master The above git info (and bugzilla) shows that the commit id got merged/fixed in 2.46 branch. And so it documented as fixed from 2.46. And, it is not shown by any tool as unresolved but we see CVE's status is well documented and maintained in kernel-recipes https://git.openembedded.org/openembedded-core/tree/meta/recipes-kernel/linux/cve-exclusion.inc So, We thought of maintaining the CVE's status for toolchain components from now. >> +CVE_STATUS[CVE-2025-69649] = "fixed-version: Fixed from version 2.46" > According to https://nvd.nist.gov/vuln/detail/CVE-2025-69649, the CPE > for this one is "cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*". Please include > some info/links in the commit message to confirm that this was fixed for > v2.46. Ok, I will add the commit reference in commit message while sending v2. Thanks, Harish > > Best regards, >
diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.46.inc index ff10050dd9..dc8b6be03e 100644 --- a/meta/recipes-devtools/binutils/binutils-2.46.inc +++ b/meta/recipes-devtools/binutils/binutils-2.46.inc @@ -34,3 +34,6 @@ SRC_URI = "\ file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \ file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \ " + +CVE_STATUS[CVE-2025-69646] = "fixed-version: Fixed from version 2.46" +CVE_STATUS[CVE-2025-69649] = "fixed-version: Fixed from version 2.46"