| Message ID | 20250717120210.3061934-1-Yash.Shinde@windriver.com |
|---|---|
| State | New |
| Headers | show |
| Series | [kirkstone] binutils: Fix CVE-2025-7546 | expand |
LGTM On Thu, Jul 17, 2025 at 5:02 AM Yash Shinde via lists.openembedded.org <Yash.Shinde=windriver.com@lists.openembedded.org> wrote: > > From: Yash Shinde <Yash.Shinde@windriver.com> > > Report corrupted group section instead of trying to recover. > > CVE: CVE-2025-7546 > Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b] > PR 33050 [https://sourceware.org/bugzilla/show_bug.cgi?id=33050] > > Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> > --- > .../binutils/binutils-2.38.inc | 1 + > .../binutils/0043-CVE-2025-7546.patch | 44 +++++++++++++++++++ > 2 files changed, 45 insertions(+) > create mode 100644 meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch > > diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc > index f1c29015bc..70176c791c 100644 > --- a/meta/recipes-devtools/binutils/binutils-2.38.inc > +++ b/meta/recipes-devtools/binutils/binutils-2.38.inc > @@ -78,5 +78,6 @@ SRC_URI = "\ > file://0040-CVE-2025-1182.patch \ > file://0041-CVE-2025-5244.patch \ > file://0042-CVE-2025-5245.patch \ > + file://0043-CVE-2025-7546.patch \ > " > S = "${WORKDIR}/git" > diff --git a/meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch b/meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch > new file mode 100644 > index 0000000000..da4dc3fb39 > --- /dev/null > +++ b/meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch > @@ -0,0 +1,44 @@ > +From 41461010eb7c79fee7a9d5f6209accdaac66cc6b Mon Sep 17 00:00:00 2001 > +From: "H.J. Lu" <hjl.tools@gmail.com> > +Date: Sat, 21 Jun 2025 06:52:00 +0800 > +Subject: [PATCH] elf: Report corrupted group section > + > +Report corrupted group section instead of trying to recover. > + > + PR binutils/33050 > + * elf.c (bfd_elf_set_group_contents): Report corrupted group > + section. > + > +Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b] > +CVE: CVE-2025-7546 > + > +Signed-off-by: H.J. Lu <hjl.tools@gmail.com> > +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> > +--- > + bfd/elf.c | 23 ++++++++++------------- > + 1 file changed, 10 insertions(+), 13 deletions(-) > + > +diff --git a/bfd/elf.c b/bfd/elf.c > +index 14ce15c7254..ee894eb05f2 100644 > +--- a/bfd/elf.c > ++++ b/bfd/elf.c > +@@ -3611,8 +3611,18 @@ > + break; > + } > + > ++ /* We should always get here with loc == sec->contents + 4. Return > ++ an error for bogus SHT_GROUP sections. */ > + loc -= 4; > +- BFD_ASSERT (loc == sec->contents); > ++ if (loc != sec->contents) > ++ { > ++ /* xgettext:c-format */ > ++ _bfd_error_handler (_("%pB: corrupted group section: `%pA'"), > ++ abfd, sec); > ++ bfd_set_error (bfd_error_bad_value); > ++ *failedptr = true; > ++ return; > ++ } > + > + H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc); > + } > -- > 2.49.0 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#220535): https://lists.openembedded.org/g/openembedded-core/message/220535 > Mute This Topic: https://lists.openembedded.org/mt/114201610/1997914 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- >
diff --git a/meta/recipes-devtools/binutils/binutils-2.38.inc b/meta/recipes-devtools/binutils/binutils-2.38.inc index f1c29015bc..70176c791c 100644 --- a/meta/recipes-devtools/binutils/binutils-2.38.inc +++ b/meta/recipes-devtools/binutils/binutils-2.38.inc @@ -78,5 +78,6 @@ SRC_URI = "\ file://0040-CVE-2025-1182.patch \ file://0041-CVE-2025-5244.patch \ file://0042-CVE-2025-5245.patch \ + file://0043-CVE-2025-7546.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch b/meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch new file mode 100644 index 0000000000..da4dc3fb39 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch @@ -0,0 +1,44 @@ +From 41461010eb7c79fee7a9d5f6209accdaac66cc6b Mon Sep 17 00:00:00 2001 +From: "H.J. Lu" <hjl.tools@gmail.com> +Date: Sat, 21 Jun 2025 06:52:00 +0800 +Subject: [PATCH] elf: Report corrupted group section + +Report corrupted group section instead of trying to recover. + + PR binutils/33050 + * elf.c (bfd_elf_set_group_contents): Report corrupted group + section. + +Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b] +CVE: CVE-2025-7546 + +Signed-off-by: H.J. Lu <hjl.tools@gmail.com> +Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> +--- + bfd/elf.c | 23 ++++++++++------------- + 1 file changed, 10 insertions(+), 13 deletions(-) + +diff --git a/bfd/elf.c b/bfd/elf.c +index 14ce15c7254..ee894eb05f2 100644 +--- a/bfd/elf.c ++++ b/bfd/elf.c +@@ -3611,8 +3611,18 @@ + break; + } + ++ /* We should always get here with loc == sec->contents + 4. Return ++ an error for bogus SHT_GROUP sections. */ + loc -= 4; +- BFD_ASSERT (loc == sec->contents); ++ if (loc != sec->contents) ++ { ++ /* xgettext:c-format */ ++ _bfd_error_handler (_("%pB: corrupted group section: `%pA'"), ++ abfd, sec); ++ bfd_set_error (bfd_error_bad_value); ++ *failedptr = true; ++ return; ++ } + + H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc); + }