From patchwork Thu Dec 12 14:35:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yash Shinde X-Patchwork-Id: 53997 X-Patchwork-Delegate: steve@sakoman.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA0C2E7717F for ; Thu, 12 Dec 2024 14:35:31 +0000 (UTC) Received: from mx0a-0064b401.pphosted.com (mx0a-0064b401.pphosted.com [205.220.166.238]) by mx.groups.io with SMTP id smtpd.web11.20946.1734014124729921100 for ; Thu, 12 Dec 2024 06:35:24 -0800 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=permerror, err=parse error for token &{10 18 %{ir}.%{v}.%{d}.spf.has.pphosted.com}: invalid domain name (domain: windriver.com, ip: 205.220.166.238, mailfrom: prvs=207616a842=yash.shinde@windriver.com) Received: from pps.filterd (m0250809.ppops.net [127.0.0.1]) by mx0a-0064b401.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 4BCALcEY018304 for ; Thu, 12 Dec 2024 06:35:24 -0800 Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 43cwy1wpms-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 12 Dec 2024 06:35:24 -0800 (PST) Received: from m0250809.ppops.net (m0250809.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 4BCEZNnN002999 for ; Thu, 12 Dec 2024 06:35:23 -0800 Received: from nam02-dm3-obe.outbound.protection.outlook.com (mail-dm3nam02lp2041.outbound.protection.outlook.com [104.47.56.41]) by mx0a-0064b401.pphosted.com (PPS) with ESMTPS id 43cwy1wpmq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 12 Dec 2024 06:35:23 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FnbPC3qEYIPuoOfkzjJCzrujhPo33XbAESiRQXFB3i9m+vSP4H3cKnd1U8MiIO/GKO8QWY/6qgDUCigAmzMmHgt4u4q80MwDfi19LFyL8MbwkybiNdV3bd3KTsfz5gqRXZxx3wse32+67Ce1Gk2GBiXMF/ubh/WKqBohtYT9V6tsMCizlswE+nOLDlVgtXPNrvH4mcprxj1AU60tyua5/XTQvHWn0sXnrUTTHUSgmGBWggSnm+TD38IcoeI5HxvHzL5apaIFoXo5q0RFC2aULztJFHo1DS3RWU4NUoPH2n4p+awPnrK10K26ZmWEntFAHmvBn/6XJ4xdNIrVsH9NWg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=4g2aN73ImlcLjPNINfxl7EkmfAM/ozsI5jKBng1InIQ=; b=wfdnqWB8SWP4QwgQ+bcENSClP+HJm2k7gk2inRH+hy9JT8Ktrt/HcbWqRhKKUfVGLdPQAhVG0bQ6yIveEt8jJ7YU/ksnFu2fk6LmQB2Srli4Soz/hI94LompeKRNK5/CvyLGRhfADgTtiLBz+nyadf8z4k8bTFqoBzT6ySi0th1yYeIs10zYHjk573pMb24RQKrSk+C83O7aF9IWMZT+vTjPh1mgntHh+zwl+hLT6FbgyvA9x7pI3JSi3v4Icf3v83rCTBYmwUYa39ADsnHWIMO9qOEP9zFTx8KZity+Bb17PhZ94AeUmUFD5l1DA+PqRjZc/cN4TCRZZLniS8my2Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=windriver.com; dmarc=pass action=none header.from=windriver.com; dkim=pass header.d=windriver.com; arc=none Received: from PH7PR11MB7593.namprd11.prod.outlook.com (2603:10b6:510:27f::9) by PH8PR11MB6831.namprd11.prod.outlook.com (2603:10b6:510:22d::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8251.16; Thu, 12 Dec 2024 14:35:19 +0000 Received: from PH7PR11MB7593.namprd11.prod.outlook.com ([fe80::2688:e731:421b:5ebc]) by PH7PR11MB7593.namprd11.prod.outlook.com ([fe80::2688:e731:421b:5ebc%4]) with mapi id 15.20.8230.016; Thu, 12 Dec 2024 14:35:18 +0000 From: Yash.Shinde@windriver.com To: openembedded-core@lists.openembedded.org Cc: steve@sakoman.com, Randy.MacLeod@windriver.com, Sundeep.Kokkonda@windriver.com, Yash.Shinde@windriver.com Subject: [styhead][PATCH] binutils: Fix CVE-2024-53589 Date: Thu, 12 Dec 2024 06:35:05 -0800 Message-ID: <20241212143505.3625521-1-Yash.Shinde@windriver.com> X-Mailer: git-send-email 2.43.0 X-ClientProxiedBy: BYAPR01CA0025.prod.exchangelabs.com (2603:10b6:a02:80::38) To PH7PR11MB7593.namprd11.prod.outlook.com (2603:10b6:510:27f::9) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PH7PR11MB7593:EE_|PH8PR11MB6831:EE_ X-MS-Office365-Filtering-Correlation-Id: 42a291ea-3a91-45f4-c968-08dd1aba3364 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|52116014|366016|1800799024|38350700014; X-Microsoft-Antispam-Message-Info: =?utf-8?q?nYG0ssAqDDTjFdrSlrA6wkQEsALATqA?= =?utf-8?q?ADLVtZ44kh95b9z6cUz8LwPZ/gYfF3KgrwoAO9yVEM8GIjKOTyg8DxLWUdY2tWbMX?= =?utf-8?q?YMmtiJ9huDXwWvUB+Ek4AX98/OP4RGywEfj5WsSD0mIxQAiyAgb1cup32gRroijU2?= =?utf-8?q?uSYcvlSAk4MNdWbTHu+Ju2lerClU5CXF7LmKu5sGq1B14VONgFBiPToVXlJBWHURt?= =?utf-8?q?pdkTu4CVOIVzi753+baLOsm2CkjsqbGuhmxh01QpQCjYgX7zn9Kk1u8Kro7xQSdtQ?= =?utf-8?q?vVkq5iNRGX9/RxOcJwKD4eQbJm/O+WgBRpltIK66+7sQ8JXbhOxgZYWfJhYbclRKn?= =?utf-8?q?0S1FgeY2h3aSv+UAz4NAd3ECOpChV8Gl3Y7sGQd9bs9fSuO1kPWCkB89w4VqTp7ZS?= =?utf-8?q?BeJAsdm2AqiZ1XjTeDjix1WI2JX7o4JLvh4rSqYS+YL+VFSksFiDh0+Bblc+SGKR/?= =?utf-8?q?j2EKBBM68ZtK6YSdAk3vSbwL1pbu6mqU/srWAtG2R9sNrS9KIkR9Mao0Xyo3ZcaKr?= =?utf-8?q?LLC3eux5cmrO4OL0PjTGLDZyLiP7LD7hyUl5/KgjzWDKusodu0KLmqE94nNA9laDF?= =?utf-8?q?fytV3fGdeO3bbeZzosg3BcMCO4gDmCEVREgZBDstsiww4lL3iRKeSHb50EKHSEaGZ?= =?utf-8?q?RGVv+/Mw9fQEM97BUdwdKZFp3u5VL3FXPv6HIbjeHb43o/Li8kMFwfszu96PCf1TL?= =?utf-8?q?ud4pKTAkM63Gcr8V61VVhraeDjIqVpbWmo3eAuwuLVhf68/lnDE1yYrOHIf9w3dHH?= =?utf-8?q?WODfSzGdOBUlvepVPuq5BKmq8V3ggl4dRRp7rrYqdAoG4q8SBIt45HAJSJklE1P2l?= =?utf-8?q?U+enrNUzD/UwHntx90DLBRBsMu17NRGX+RXHDWGZNCalw353bvSowSmj2w89G59uI?= =?utf-8?q?5flN6BHVP5SCHJyl1kre2FLxWaUPPYfvnBDcQZoKh6HGXPDxmQXHL1ocMpd6ryWpy?= =?utf-8?q?WWFHZl0FtbjI7WPQrQYYCIbFlBAFoObgYmN2t50bYEpj5zRG+Hqy/20I8vMEae7uH?= =?utf-8?q?btx49OkNJ4WmgKvGmPsG7RKXSTbo/qUttHTkIcEiGPDuspzzbXv7LwdDCCWy5D2CJ?= =?utf-8?q?2GOJjEPw8e2UOI0uIfO+Cd2diUODwmQVbdGIyum33zHQ7jk+Wm5yh91Bjf4U3q01f?= =?utf-8?q?y338BDTzEc904pEaHqBhfzXxaPK1irUUamgGFM9ljP+hG8zhM93c45OCqh6srvgCt?= =?utf-8?q?Vk5PD8pb746N06Rcpyjpj4rfhI8p9E7Ss3TNwmb75Q6dAnZFivPedB3EWEEO2wLbD?= =?utf-8?q?GQS1mgK7eVNK3aALaQxRNfGwI3ttEP7NfPhve3w2jGZ1NUs9V2aJg0U4=3D?= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH7PR11MB7593.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(52116014)(366016)(1800799024)(38350700014);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?q?Zr6Cc3tHWmqifm6EYGc1UhjeAYZV?= =?utf-8?q?2sHmRbeuONtrFTM2cj29QEPHPkVxjr6rEoGnqTZ++Kj9TnawXUaiHuVrXDtl3Qfh2?= =?utf-8?q?eyi6zXUl7B154oe/VzAoMTknPYCgW/p3ObfeC7I0saq+Kq9ar0Bw8Ff+5lja5mUha?= =?utf-8?q?brIojRB5rUtekZKsWAtQZwTsZ9GQYgVKbh7ICJk3TyQSkcz3dwcW0r9vR7mHqNm5P?= =?utf-8?q?ntdrBchEEF+r55BeNEMlL5eiWvvOKeTtmNo4AdAoHqVMrf07ZS/ER0ImctwGu+hGz?= =?utf-8?q?Rxv2aa8Srcxx4fiwlxQ/L+UTDnyx8gtbt0A4hkpAdXhsPKG+zGKqe44RWd9544Cz1?= =?utf-8?q?gx0v0bCDaLiaYpsLPxlNKkSE1voFUnHaWopFjyaIHkNOr7+VwCLsUt656E2uRDZDI?= =?utf-8?q?9o/dv8+c03fgqKyr/7lAgKyPjQtMOqNC182yjQBssqLSjTqzgt0zTX9sSU2FVjOGH?= =?utf-8?q?JqI3hniy5G6Ldmuz5/YD1AYBc5JAG5NDTj7wVdiFZBKt48cWe6xCMOHtBpyS9wRGC?= =?utf-8?q?Iiymmpgg/fa8avTviqCCP+pMjQ5OEqd+M0KReCpqtJbTsP+NsH6u/ntuU/Ke1qXOp?= =?utf-8?q?AinVLItXLaK4dd2tSJETGf2G05yMqvM+77qDr7fFIdz9I022ZVTcHG1NIljU7JQpL?= =?utf-8?q?c/H+WwZg/8uQPWlSsTWARjMK6R0IVp+mBa2wTJ8EZ/jG32y9Ar3cbvXtxFBZIcMav?= =?utf-8?q?/6RV0iTxDtrcy6esaiHBtmNSmiyLOVylM05ZXu3fMwruVIeqW0GsdB1UGrmQxa43Z?= =?utf-8?q?USISG16bs1yzw8z/oopczjzjZaDNBWgYGkl4AN1kqBzc7EMzcl+gDx2hBC2WIerK8?= =?utf-8?q?i/JM+JBY43M80IFCBJKHujLUllQy0X/b1ul2IcJWbx+uT4ri/dBFW4PbeyM9mc0JG?= =?utf-8?q?ZkDyfQOq8E76QcTI9o52vkzaI32yWhl3PvOWekl+Ke4argpyD0KA8acPECw02BsW4?= =?utf-8?q?IovLrTkx0ybVwurKQovwPOdgHWXRtLymNwThBWb7PpLWiXlerd1sTQGdVQ7RUmnuS?= =?utf-8?q?Gp4k8+YZ37+FBlFS4RuWvb/S13HLYrnPduZhhdGr5pQ52u8/GYK0QIkumm7RG2uyE?= =?utf-8?q?vVIQ3EnvHSFHLIaUYMeSp2PKX+guyqBnIL5IjP8fW8L7QocWl3RXQG2vIPTXinooY?= =?utf-8?q?cHhZOwZShp+8bdm0oLpxXijEC4tipVwn0djGNsVTBZdoSgfb6i7IDckn6yFo/k8SG?= =?utf-8?q?IqN7tbRpZhx5EbBMt+zlDxprvLzdi5O5/TEHw1bSPV85VP/uSJg08vz5TDiGgp7U1?= =?utf-8?q?FxxJXOrS4P15L8WmN5P/BTozMz2IXh3A8eGVx378ILjZZ+gzp3TYOe8wpVexVcp2r?= =?utf-8?q?uHPKfG+AI9fzxHKpVkk1jF0dS0IMUkbX9nZTqNhUuOUL4hxa8j+MaqPbSWBSP8rbS?= =?utf-8?q?hfWctU+vQNruECpim1/fnbbbKgRPkzVn+hxxg9rgYaeyytLSN1wGM7twXwN9AEAHK?= =?utf-8?q?K5S0B2azNJmYJvK1UO/yzRCHGfiy125/H1ed3/5BODk8aAEV0Nj8NAa/Y3H09PmhN?= =?utf-8?q?VQFBwQU4NcfFLXlp4n4fZUV4DCi3kiLdmw=3D=3D?= X-OriginatorOrg: windriver.com X-MS-Exchange-CrossTenant-Network-Message-Id: 42a291ea-3a91-45f4-c968-08dd1aba3364 X-MS-Exchange-CrossTenant-AuthSource: PH7PR11MB7593.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Dec 2024 14:35:18.8411 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: B7h/U2UMTeflbvVwMVlHt9tCTzwMGOR72qFSVdmMJxu00IMtLh8a49Rf3NGmV35WVpOGnUuhezisGrOWXGTcqCsIfBtJySUWCnCZvxm5nPg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR11MB6831 X-Proofpoint-ORIG-GUID: cNjkiBDqDuYvb0zNdQCTVlKN3uhkaSqe X-Authority-Analysis: v=2.4 cv=eePHf6EH c=1 sm=1 tr=0 ts=675af4ac cx=c_pps a=YTelpZo7+Gv92UPfPuytLw==:117 a=wKuvFiaSGQ0qltdbU6+NXLB8nM8=:19 a=Ol13hO9ccFRV9qXi2t6ftBPywas=:19 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=RZcAm9yDv7YA:10 a=bRTqI5nwn0kA:10 a=CCpqsmhAAAAA:8 a=t7CeM3EgAAAA:8 a=pGLkceISAAAA:8 a=QkpFdd30EMMon_xh91kA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=ul9cdbp4aOFLsgKbc677:22 a=FdTzh2GWekK77mhwV6Dw:22 X-Proofpoint-GUID: T4YpMTARZ0j97oIXVSRV_ts8TVVxdmo7 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1057,Hydra:6.0.680,FMLib:17.12.68.34 definitions=2024-12-12_09,2024-12-12_01,2024-11-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 impostorscore=0 lowpriorityscore=0 suspectscore=0 mlxlogscore=999 priorityscore=1501 spamscore=0 phishscore=0 malwarescore=0 mlxscore=0 adultscore=0 bulkscore=0 classifier=spam authscore=0 adjust=0 reason=mlx scancount=1 engine=8.21.0-2411120000 definitions=main-2412120105 X-MIME-Autoconverted: from 8bit to quoted-printable by mx0a-0064b401.pphosted.com id 4BCALcEY018304 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 12 Dec 2024 14:35:31 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/208648 From: Yash Shinde A buffer overflow vulnerability exists in GNU Binutils’ objdump utility when processing tekhex format files. The vulnerability occurs in the Binary File Descriptor (BFD) library’s tekhex parser during format identification. Specifically, the issue manifests when attempting to read 8 bytes at an address that precedes the global variable ‘_bfd_std_section’, resulting in an out-of-bounds read. Backport a patch from upstream to fix CVE-2024-53589. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88] Signed-off-by: Yash Shinde --- .../binutils/binutils-2.43.1.inc | 1 + .../binutils/0015-CVE-2024-53589.patch | 92 +++++++++++++++++++ 2 files changed, 93 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/0015-CVE-2024-53589.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.43.1.inc b/meta/recipes-devtools/binutils/binutils-2.43.1.inc index 1ce19fbdc6..94e7d7f7e6 100644 --- a/meta/recipes-devtools/binutils/binutils-2.43.1.inc +++ b/meta/recipes-devtools/binutils/binutils-2.43.1.inc @@ -35,5 +35,6 @@ SRC_URI = "\ file://0012-Only-generate-an-RPATH-entry-if-LD_RUN_PATH-is-not-e.patch \ file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \ file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \ + file://0015-CVE-2024-53589.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/0015-CVE-2024-53589.patch b/meta/recipes-devtools/binutils/binutils/0015-CVE-2024-53589.patch new file mode 100644 index 0000000000..380112a3ba --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/0015-CVE-2024-53589.patch @@ -0,0 +1,92 @@ +Author: Alan Modra +Date: Mon Nov 11 10:24:09 2024 +1030 + + Re: tekhex object file output fixes + + Commit 8b5a212495 supported *ABS* symbols by allowing "section" to be + bfd_abs_section, but bfd_abs_section needs to be treated specially. + In particular, bfd_get_next_section_by_name (.., bfd_abs_section_ptr) + is invalid. + + PR 32347 + * tekhex.c (first_phase): Guard against modification of + _bfd_std_section[] entries. + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88] +CVE: CVE-2024-53589 + +Signed-off-by: Yash Shinde + +diff --git a/bfd/tekhex.c b/bfd/tekhex.c +index aea2ebb23df..b305c1f96f1 100644 +--- a/bfd/tekhex.c ++++ b/bfd/tekhex.c +@@ -361,6 +361,7 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + asection *section, *alt_section; + unsigned int len; ++ bfd_vma addr; + bfd_vma val; + char sym[17]; /* A symbol can only be 16chars long. */ + +@@ -368,20 +369,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + case '6': + /* Data record - read it and store it. */ +- { +- bfd_vma addr; +- +- if (!getvalue (&src, &addr, src_end)) +- return false; +- +- while (*src && src < src_end - 1) +- { +- insert_byte (abfd, HEX (src), addr); +- src += 2; +- addr++; +- } +- return true; +- } ++ if (!getvalue (&src, &addr, src_end)) ++ return false; ++ ++ while (*src && src < src_end - 1) ++ { ++ insert_byte (abfd, HEX (src), addr); ++ src += 2; ++ addr++; ++ } ++ return true; + + case '3': + /* Symbol record, read the segment. */ +@@ -406,13 +403,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + { + case '1': /* Section range. */ + src++; +- if (!getvalue (&src, §ion->vma, src_end)) ++ if (!getvalue (&src, &addr, src_end)) + return false; + if (!getvalue (&src, &val, src_end)) + return false; +- if (val < section->vma) +- val = section->vma; +- section->size = val - section->vma; ++ if (bfd_is_const_section (section)) ++ break; ++ section->vma = addr; ++ if (val < addr) ++ val = addr; ++ section->size = val - addr; + /* PR 17512: file: objdump-s-endless-loop.tekhex. + Check for overlarge section sizes. */ + if (section->size & 0x80000000) +@@ -455,6 +455,8 @@ first_phase (bfd *abfd, int type, char *src, char * src_end) + new_symbol->symbol.flags = BSF_LOCAL; + if (stype == '2' || stype == '6') + new_symbol->symbol.section = bfd_abs_section_ptr; ++ else if (bfd_is_const_section (section)) ++ ; + else if (stype == '3' || stype == '7') + { + if ((section->flags & SEC_DATA) == 0)