From patchwork Wed Aug 12 07:28:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95003 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 981ADC5B56A for ; Wed, 12 Aug 2026 07:28:33 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2585.1786519710665362221 for ; Wed, 12 Aug 2026 00:28:31 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=bWFoI38j; spf=pass (domain: est.tech, ip: 52.101.69.41, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Tumb6tek2TFF/YemG1GZq9V6LgEHRjSiJ4kawY2FKDtyTnRhtmn+Jpzwsi+ljZgXQNjo53MME5NWp8rRTS7bK9c5DfjXSVdv1IHM2S4wEzNyU2aaRIJ7B//44jsOK74UdSloqil97JQ7e/cH+rkOMKXsUJglqYTeR5G2ecmGm4976S7QJQl7hNqgNUYF++7bdcql/J4PXWtFwWRVomhi4mCm5J8KnDQfjc12cXupSjBA5ziJKaX4xSBQA2F3wnsaOtvaTU6x1nlb3yeb3/xBiep7V0hgvI9+GVXqEshPH7og6YLqmR4TPRmZrW4SuFX4x/Me5UrqOMwXIlJXAR9ylQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QTW5CVUwQH0WP5kmovY7bGNLSPOHg72gAD5J7bXWF+w=; b=puUM8l/06lA2OtSIxxH5xx1qsV34cYfsWN+RLTRa2AyDlmbH8tFxK108TjTbkOUkBPvFlOmFDtvkZX6Ny0bIqWmOpLi/sqdGCvAtYELfHdlIWZk4w3iJwnX9uBexi+aUd3uuTx4AFqXu1ODJqFBY2/RTdcLANv6sKXCHhErpXj7oOD5FiXmGbnlic37II6t7Qd4VCQ4d3kxxGzyT9xyZE+wcEvZTDxIVQH5LtNgt2n4K2Uh/Haoro4HwuLBRy3ySUjcy9WRCdhuD/owF/t+LAB1TGE1kVdIm+Yt+EU2ik97fOs9+5O51GSF2LWaDYx0Adh07yQ/gljhrUQ8W0tS3Xg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QTW5CVUwQH0WP5kmovY7bGNLSPOHg72gAD5J7bXWF+w=; b=bWFoI38jLvUtrcE3vEdDzmvcQYK6ATRsOkRNjHCQu9iMQlZbPS1o1lVejlaJ3ncXKP6ifHlf2XPoLmAbZZ5RqkYrnIuIlKUseLxHZ78Wcf7RcGVqkqwWKmFbe7ksIX1glWf/V640xMxvsrkhB6H7hL5BuVvTv6Y+ma6SG4Nju4yTYWae1yAHjvz6a17u8vp3up9hGOB5l7k/x9Sos7uy20+k0ZsGbGGJgi7DhrjWQhaK7hc0aBLMc42fOvXb4BzKDc5yT3cqy9EHcGOs7eJjBiDSwbmBcv6lK0WMESlMxqyovoIVziGS3/RKCNJIYlw21JCxI9aq1rEJF54Ixa+FEA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by BESP189MB3212.EURP189.PROD.OUTLOOK.COM (2603:10a6:b10:f5::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.3; Wed, 12 Aug 2026 07:28:29 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 07:28:29 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH 1/4] binutils: fix CVE-2025-1147 Date: Wed, 12 Aug 2026 09:28:19 +0200 Message-ID: <20260812072822.22227-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812072822.22227-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DB9PR05CA0020.eurprd05.prod.outlook.com (2603:10a6:10:1da::25) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|BESP189MB3212:EE_ X-MS-Office365-Filtering-Correlation-Id: ab162b71-3404-462e-f8e2-08def8434df7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|376014|366016|6133799003|56012099006|11063799006|10067099003|3023799007|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: jUANzd9ixFcGu5b59CIuc9gw1z9Q5pZSCSpOZWKN8d9+4kprSnVwPu4742k2z2n6qPPA6urEq4FmIDlBINjyzUcyCO6aGpVipxsbR7m1gWNyPt/FD2cpXSPK7Uuiz7cD7hcLy2i+QFi7fbj1Zn6irMruXoqSYA9BZ8v028sQ3raqm8dz9rSuCa+T58U/I52Y6Evs9nQWm+5cuOWpVlGaVFhMG9EVECxb9ajgtxAw8FMp2jM4zWuDv9cX8I+54UvSUYTa3CXdIMX+q9klDMPrDCqQVqhR+aw3YGHCyGFSrs0OnHWpHA7y9/XRBoAM6HOqclspeE1Vs4jOy54dMgPeM38/CdjMZkKWjoSPO7CRjwBwfyjMPCcSzG20RuYshOjLeLsaHxDkpFRsLd578Znnzaxqv6KhooRhdPkgh5qTgzPquGPywzmPBVA4thhflnZs6hdouaX3m6+D0jq3Tvu/r6QB69I2iV6mEbZXUBcXUSeSt5HSpzMfiC15vWlu3f3tJRVhKlQiNILs4ZidZiTSugdwztliIm0Jfw23CWrK53ZQB/wVwapUPcdlqyF4+uHTsooo50L8uCizMY3ED9VL/M1VxxubISN0JTShI4ahhSE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(376014)(366016)(6133799003)(56012099006)(11063799006)(10067099003)(3023799007)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: LnDtfekago/sXW7wm2KLPfx18MfTIKOEdYypNL8hT0zdjjHe7sbH6SASzG9B4Z141yF7HgdgccyzuCiRsM9m9ibJt9PJCU6pA1ATSnxWqy5WR/NK3rV3HN6rE72+V+/bhGUaTn5cfuV/cEnNCQpp8fkZDkN1LWH3OttvT1vcfFn1IJ3it0ae4Hn/PI8dp04LOfYvksKoBA7jmjyqT6WQgGyTOS24+lKSumSHc8m0zyW4Td2IK3V4ci7VY+WMbaN2Wc4miJ60UVmvo53eNrQEIa+X42m5iw0z9Om3J+NbBzEAVqzB39aQyraVZPfjhMSUohZa7d+BgtM+8efVALC/T6csqFFQGM2cEuGAUBEWFfdb+z3NGpbvhotK2FfO7u04D2jZrG2J5jZNKLawIzxUSBth3eKznv/pdZM97+omScmKtQfRwvD9GFjLWxZDJHVCa02csmSUZQJZSFQ7oYvahhH9P6jybnq0Z1nvpn4px2NzwXXcrN2jR/zqKxHdJhSrWbB47e1blB2CfAI9YfRq7CmHOItHNKcNrEpIEv1/bZRvOPiGCZLo/U4j3M8C7Zorpb01QXiGtAH7ysFfojLnZf+AQvVAC0yqvLzxKqOlJF3j3kqgBNPQb/mt5v35l6+WS+NKgxsAgCNtuYVaD6ZDU0ZjHSbphib+zqssaKLK7HBynErX4XCNImbAUu0jmwdEph4+F6g/CJKhSkYB76HgZOHiUfdnpHq83TE3QGQRIT0YSG/HeGFpTORBi4hWxiiwmu7KDscsWB5OTcytOMb+Pytv1h/OCbT4EeePjzt7lGjS/i1uIEtPJZmtWr/l7krTf7bYo1Ghy3O6k5+VgnXjCpvw1ZoUHB9xrpJCseki6QGRyA3uniq4F4E85mc6TJkAzjdgUkHOvEF7t54sUMHmKcGOgQgcBnhSkKcAlU1dcV9sWgGu6ERlchuEc4Qzg6NXc8QjdIpyI2gC2yjrtLrCbX9yv7HR1GgPU7/xw91KXqFrs7LNNWf2yNVwFOuOwAKsOwuj0uWY0tMz8LEBszvTbuGoJ0774/ja1OEbGCY9GA1rMrv8eSKi7zgYn8jlpjIbiwTNktCrImzRVYZ8kfnaoo5WWf4xt2R5Lz65sRisgXg/4durMMiaICbXLJDGlpBjYSTJYe7nL91Wc9NvGmmk84BftHuys5nsai8ZfX9zWeOI2U+ieKGRRj0g7Xu+fY6Jkvdhm/keXv1TjrcWEZFt+fX0OPYaEyeumfDZsI6JYlYW2MGUFiwOwtoYwTM/mzY7J/BaEOFOxmxj7PrfZp3shN6KGT9LfL7mkcvHK8ug1AYCXuSsYtF02+fe6igtHm7tgLdGUu0GmCRRdYE8+keIePPWyRyGuY/GBcxBnIYb8KyxO+/3TrDjQN/bRzYVYqIWg3JUoSk1v8CHN5EQ11IxLsrISMec5qaGeQq/C8GA4NHCfXcxYObit+Mw80ld1V02tcgWj7/NX2tqMPAv2KlUQw43XUor7Y/5BvtoueXE8ChdddhiIzIk9vVkeGsvuXh3shQSyUozswh1lQEcOphJreYE4FeGeszB1Wiu4nUeZvHw0XgiGVUFvN7hy0jdQNNR4Lklprk2NBogXkUX0VfdaYgfIYU/3O5zXZymvvHJbbSMSNCPOBMkrqkwXfqHRVY8kS3fq+7qs28WRuocwyBmtQyWltTVov4HNuL5TmIAZS6KYbPRfw2uc6STqSiiXuOlFYu4M3QpQpYdyR0+CWHVk1eQAMF2qbnKI9yTB4r3XoI= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: ab162b71-3404-462e-f8e2-08def8434df7 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 07:28:28.9778 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UI71W/5OuAXFukHQbAkixRP5WH5IMOSQDfkxOK7Ti/V+qiHNW7sxnFns8XAuGyVApG5q/GTUSefspR4FLu6PX2eDV+6YtaLBC71wmTqozxs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESP189MB3212 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 07:28:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243248 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-1147 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=7be4186c22f89a87fff048c28910f5d26a0f61ce Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported (+2 new passes from nm --ifunc-chars=-- tests) gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2025-1147.patch | 110 ++++++++++++++++++ 2 files changed, 111 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index d455acd786..063c6cc2a4 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -78,5 +78,6 @@ SRC_URI = "\ file://CVE-2025-69652.patch \ file://CVE-2026-6846.patch \ file://CVE-2025-69645.patch \ + file://CVE-2025-1147.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch new file mode 100644 index 0000000000..d8a3f90ede --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch @@ -0,0 +1,110 @@ +From 7be4186c22f89a87fff048c28910f5d26a0f61ce Mon Sep 17 00:00:00 2001 +From: Dmitry Klochkov +Date: Tue, 9 Sep 2025 12:06:25 +0200 +Subject: [PATCH] nm: fix treating an ifunc symbol as a stab if + '--ifunc-chars=--' is given + +If an ifunc symbol is processed in print_symbol(), a 'type' field of a +'syminfo' structure is set to any character specified by a user with an +'--ifunc-chars' option. But afterwards the 'type' field is used to +check whether a symbol is a stab in print_symbol_info_{bsd,sysv}() +functions in order to print additional stab related data. If the 'type' +field equals '-', a symbol is treated as a stab. If '--ifunc-chars=--' +is given, all ifunc symbols will be treated as stab symbols and +uninitialized stab related fields of the 'syminfo' structure will be +printed which can lead to segmentation fault. + +To fix this, check if a symbol is a stab before override the 'type' +field. Also, add a test case for this fix. + + PR binutils/32556 + * nm.c (extended_symbol_info): Add is_stab. + (print_symbol): Check if a symbol is a stab. + (print_symbol_info_bsd): Use info->is_stab. + (print_symbol_info_sysv): Use info->is_stab. + * testsuite/binutils-all/nm.exp: Test nm --ifunc-chars=--. + +Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=32556 +Fixes: e6f6aa8d184 ("Add option to nm to change the characters displayed for ifunc symbols") +Signed-off-by: Dmitry Klochkov +--- + binutils/nm.c | 10 +++++++--- + binutils/testsuite/binutils-all/nm.exp | 17 +++++++++++++++++ + 2 files changed, 24 insertions(+), 3 deletions(-) + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=7be4186c22f89a87fff048c28910f5d26a0f61ce] +CVE: CVE-2025-1147 + +Signed-off-by: Jaipaul Cheernam + +diff --git a/binutils/nm.c b/binutils/nm.c +index dce9207f44f..c3d118a93c3 100644 +--- a/binutils/nm.c ++++ b/binutils/nm.c +@@ -70,6 +70,7 @@ struct extended_symbol_info + bfd_vma ssize; + elf_symbol_type *elfinfo; + coff_symbol_type *coffinfo; ++ bool is_stab; + /* FIXME: We should add more fields for Type, Line, Section. */ + }; + #define SYM_VALUE(sym) (sym->sinfo->value) +@@ -1208,8 +1209,11 @@ print_symbol (bfd * abfd, + + bfd_get_symbol_info (abfd, sym, &syminfo); + ++ info.is_stab = false; ++ if (syminfo.type == '-') ++ info.is_stab = true; + /* PR 22967 - Distinguish between local and global ifunc symbols. */ +- if (syminfo.type == 'i' ++ else if (syminfo.type == 'i' + && sym->flags & BSF_GNU_INDIRECT_FUNCTION) + { + if (ifunc_type_chars == NULL || ifunc_type_chars[0] == 0) +@@ -1873,7 +1877,7 @@ print_symbol_info_bsd (struct extended_symbol_info *info, bfd *abfd) + + printf (" %c", SYM_TYPE (info)); + +- if (SYM_TYPE (info) == '-') ++ if (info->is_stab) + { + /* A stab. */ + printf (" "); +@@ -1902,7 +1906,7 @@ print_symbol_info_sysv (struct extended_symbol_info *info, bfd *abfd) + + printf ("| %c |", SYM_TYPE (info)); + +- if (SYM_TYPE (info) == '-') ++ if (info->is_stab) + { + /* A stab. */ + printf ("%18s| ", SYM_STAB_NAME (info)); /* (C) Type. */ +diff --git a/binutils/testsuite/binutils-all/nm.exp b/binutils/testsuite/binutils-all/nm.exp +index fea68bf76bc..1feb8578fba 100644 +--- a/binutils/testsuite/binutils-all/nm.exp ++++ b/binutils/testsuite/binutils-all/nm.exp +@@ -329,6 +329,23 @@ if [is_elf_format] { + fail "$testname (local ifunc)" + } + ++ # PR 32556 ++ # Test nm --ifunc-chars=-- ++ ++ set got [binutils_run $NM "$NMFLAGS --ifunc-chars=-- $tmpfile"] ++ ++ if [regexp -line "^\\S+ - global_foo$" $got] then { ++ pass "$testname=-- (global ifunc)" ++ } else { ++ fail "$testname=-- (global ifunc)" ++ } ++ ++ if [regexp -line "^\\S+ - local_foo$" $got] then { ++ pass "$testname=-- (local ifunc)" ++ } else { ++ fail "$testname=-- (local ifunc)" ++ } ++ + if { $verbose < 1 } { + remote_file host delete "tmpdir/ifunc.o" + } From patchwork Wed Aug 12 07:28:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95005 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82AEBC5B567 for ; Wed, 12 Aug 2026 07:28:43 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.57]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.2586.1786519713474107005 for ; Wed, 12 Aug 2026 00:28:33 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=SgFiOYOK; spf=pass (domain: est.tech, ip: 52.101.69.57, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=p3BSVTJ3GuHsTFKYBbAW+dL7IMHRCaN4wxqzyJ9qPBPVUa8SL6mSaffRj1JTB/9coov2D9IMwkSvT0RAr+N94H44yQlYwmrA6KBuCMjHiewi6e266UXuum2s4jVmW9+7gRJDzrIc+s30tiOiwUrukoySfsDzb+iZibWFoUM02AUe30SRTkqcnueMb5uY/Y4TMN2w8oyKgeOYzj2pnuoJVD90zDNlTyDjtfh4ad978g/1NYZklUQ6a731MAKra8sCrZvODfVvVHfnhRUn388wAR1w2bmAnGw/5Mq+vBqhQ7OQiuzCEZ5yeAyndc83QRw82+ES6KiCp2C1K8ak8C+77Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=LH55WrgP7viDHF4inNowXEMaFkJ+AOrK5C8Ta8UJ9fE=; b=w+ernDARNulILv5N74WS8A5Qg95109Eumree0M0Rx3BN/ITz0gTAwL1mO6QRkCynJLAKEz9Qr8RfCjjpNjo1l8C+HKeKnAfOvsC3XmC0xRw5R0iLPTMh3SPX8voKgd8rs2t6niF2uYkicAOfZMu/rEwqYd1Ar/hZkcu559YlikF3QEBAfzmCM8x34xB2Th4iYnOb/I1GD65q5n5HoIBrFTIdyrNpysM3Bnm5slM1s2s4DEthIsHbaM1fVaa/SU3T92D/LmS2IRbcVBUVT9oAoS4VbSZVCjXD2GCx2maf7cyBBD4On0AP3kgHE9bmwFJ284Yqm3HPDKX2n5/wQplSBw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LH55WrgP7viDHF4inNowXEMaFkJ+AOrK5C8Ta8UJ9fE=; b=SgFiOYOKfZRJWAqBAOQIUWW/BfpVjhtEevI/eUdtnuctaARaah2oP1EeOXETmsf1xTjB5vAodBmEAOmQtQQCG58fqNRn4h6jXKafuhBzSO0PflGsI8QSDohGclHHMaM6A15i9BbjOb1vBJBEC4+NEBRM5zLcGLMazzXUDpqp7tF9HJeV3TRdhoEyzqipRTCEakQs6W+ZGbfmscJzVv3n/PzKI6L/7ZoGsU24jfFFf0zjsewGsWghRaAYOAmxzIfQfcRoPC9FJ2Vn7aTEcDMPfWS7PASSYJGkfw4CaiwdZmNg/ruYoNg59LM/1ZI1jGa9qBI4aDliHMFdNnJiqZZNQQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by BESP189MB3212.EURP189.PROD.OUTLOOK.COM (2603:10a6:b10:f5::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.3; Wed, 12 Aug 2026 07:28:31 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 07:28:31 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH 2/4] binutils: fix CVE-2025-8224 Date: Wed, 12 Aug 2026 09:28:20 +0200 Message-ID: <20260812072822.22227-3-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812072822.22227-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU7P251CA0027.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:551::25) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|BESP189MB3212:EE_ X-MS-Office365-Filtering-Correlation-Id: f42f397e-5bf8-4ed8-c249-08def8434f6f X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|376014|366016|6133799003|56012099006|11063799006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: jXNpC6gsEgTaYg4MWBPlkHIQRF07lFn5gZW5Wk0UeG9Ci6hh4G1WfuCCJmFYesMon/8nEkRiDoRy0AOEdwGAYsZw6963WPX0nmiTVLtBSuC1wEwxUI2qC1gPBaM+RQkt+gCqSDOmCqluOgpuzPCJS3dS6or8fVNN/I9r//ZhJcLcM4cMdLJsad5ssjMXdvZ7ers/XAAtZDu1bpBiDHHhDeYg2/FBdVOHtV4VBMS6sm/HBCjzCgB9Z1dimrVK/rYamxGj46OVRjL8zU/8wjCmRavlLweuPKZyTyoDNr3TlEl0f0RmYD+J/+a7d1aqsieHWmE+1Xnb4pQFrg3xCjfRp4Yz9X2P/dC7Hcm0co4uTv3p0cPEfjO3iOxq34+nLa8GypwsfoJvjHqY+9D8UqouiPyguI8WehDoDG1fgFE0I17fCkdopiluxLgs3qD5M9s+fECdI5PyAAjEE4zJ40VlLpN7Tu+QZC9RlUEp3D6fpZyNL7xEqHGmJ2mz1hCNNRzbchOixLmwcT7IX7mloj/VyJpKac0d3cqXBEMOvyWDtqX3i3ngTruqcmiKPh/cUVauc81DdN1Df2yjOY2Ae0sNgjvcIeOP6qcEwZHWvO2PLpnfBkyY+WbDreZblLc5Gp7x X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(376014)(366016)(6133799003)(56012099006)(11063799006)(10067099003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6sH6QqdX51bkBg+LHAgM15doxGlFqC+BAtL9xeVQ24Ovg8t81pn/Ttzf7y1x5GlvY1WopQ2N95ZRg9teGLUFs2jdDUrPOdCQaDe6lxAyySqHBg4/oXYKk6RHle1DBhqYN2O+IyXcugSpofHt4bdKVCs0ypGdPmylEAvFobnuYjWs8lAeTTnk5sZdgU7rpsGNVsGs3tJsaDiz/z1PQtqjta2CuIiSjAH27M2S9+ikVLObCxyUF4AUWfNF/cu/+qPKrj2M6rdimK83h0t0a5GF/NdY3XoWMFqdoF6FHmhQAsfUjcrIMeAQxL0s+8TBm/Ll7Y2gAr7MBozoDQtKpGumeYWhycNUT5iX+/6DNGeDcn+AHnQaEJXHZN/FOiGqCxkmZRpSSOtgCf9OqOgZ/Kp37eUtr6WMaejU+4WxOcwFK9kLEzP4LLLBiyYVzX73kfk1apZztMlRV+NCHm4jvfor3yiLaO/Ws5diFnjA9DfvoUswN5qtht5rtMrG+phs03Mp3eWwPsnQ5tCB1l2S0R6Iws9Al4M5kjd3jM1qjuZ/mw7JYqztTZx2JxUnANr+rLUWGy6cDjdqx5Y/2LG3sK0XGrcw2MBWoksEvUmG+ei5FBxp9Zo5g4xIt5N07DgN4wYlfuknIPLkFkMn2mqioGL9mSIt42T9sEp9iK/wtNoPxajBoGzjZNLOjYV4m2DuPJZ00Tge3+fahs0jQhGHPIsDky4XkBbdECjDjDm7SYZQGswmZNpIN1xj/Zb0FybX77DMc2r6JOIE0Ahe3qTaj0sGQAp85W5YiCtHwaViBOcTO4VHGwqt8nhm4zzzl2oDrzOCV4aQh5cV4EVDOyiTuPX5zxN7TNsIyRdwSmsR9C9BDuinzlOgv71+Ry6uJJCuuyQZEH+BYg1SntIgGuiIAVaFAUkSKxr8NQgHqryMQPf/ww4HRp5r2YJjYfnPhkmCcXYIM1Z6E8sUls6TANj8n49KRVZ0kWw3dnJYnvcsPIFl6mxs5JYI/RafTWYsUD2dQUUQZnUtSdtekhd9K7kzMkZWmgzFt7kSu0RrfpXzfs0CIrh03ONhN3dfmdiO2kJ1nWuOww3dkkR5yBMwr7IzwnpIHma1O92uqWyGYmsU0mB1DK6QpHmgfK72n3kDLZ7eBdmxz834t+wO5mbUZhLqMycaJ348EnL0Y70J1krBVzonSMzJjv+rZuoOetYRyeIZ4yLkcXy4nKeJY20xiEsNbzR9IZDunRHbsdOvFi+so5eu4k3h31TkosBs3XMo9Z1uIIvjUVjsRec9UqdKH4rXDwe5N5a0fBf2ghjKcE4dHazL4xU7RIorslIpx3C2JkTX8gwlGRWiPWto6fIoTcmPxd8LPkfBj/SHlgQAyIBpHkg97TRwiq+VticOAH1jxSFJG1wID1UgB7spx96b7IktYTTVdGKBI8cljdux2XbeXHcQUvgN4kfvBgXLELzqWK0LS3XzoNN7DUpZzSUgX4mVu9P4RvSleYKToFZqWQLwbKQzDOxwBhAHDyK4Lqtc93um0JfoHOvv6kY0pRiPEbB3x7jKxgygMdMjQj2g35VNqJhTzQX4uKfzMRAGWEtpootimk8Jap+6Hxy/RVZxLE1wGByws1D5+6OmOZt/sAS0uDa7nCZnb0dxzUjoynQmcczutu3MgpYJ4Oew6/X3NEcjZVXG+VUJywtUip7qnkoOdRIfsEfTHXv5TabeTDkReqZiFZy3Y4jBerfxi3h0vpAMjACLcHsobGSUF7Zc385NXPJkL0Q= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: f42f397e-5bf8-4ed8-c249-08def8434f6f X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 07:28:31.3643 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: iejguq41nbE06WoH+YdtChcrf2/OC3lsiGYN+LPx6ho9ANhuhzhn4WfL6zdKa7t1AdvA4IG+EcbCXNH9OZa2xm/u7bX3eEPBSCCOJIsarbc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESP189MB3212 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 07:28:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243249 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8224 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=db856d41004301b3a56438efd957ef5cabb91530 [Adapted for binutils 2.42: only the shstrtabsize overflow check in bfd_elf_get_str_section applies. The second upstream hunk (DT_STRTAB) does not apply as 2.42 already unconditionally null-terminates the dynamic string table.] Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2025-8224.patch | 54 +++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index 063c6cc2a4..5534ce577f 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -79,5 +79,6 @@ SRC_URI = "\ file://CVE-2026-6846.patch \ file://CVE-2025-69645.patch \ file://CVE-2025-1147.patch \ + file://CVE-2025-8224.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch new file mode 100644 index 0000000000..0ac8e0a1d1 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch @@ -0,0 +1,54 @@ +From db856d41004301b3a56438efd957ef5cabb91530 Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Sun, 25 Aug 2024 15:20:21 +0930 +Subject: [PATCH] PR32109, aborting at bfd/bfd.c:1236 in int _bfd_doprnt + +Since bfd_section for .strtab isn't set, print the section index +instead. Also, don't return NULL on this error as that results in +multiple mmap/read of the string table. (We could return NULL if we +arranged to set sh_size zero first, but just what we do with fuzzed +object files is of no concern, and terminating the table might make a +faulty object file usable.) + + PR 32109 + * elf.c (bfd_elf_get_str_section): Remove outdated comment, and + tweak shstrtabsize test to suit. Don't use string tab bfd_section + in error message, use index instead. Don't return NULL on + unterminated string section, terminate it. + (_bfd_elf_get_dynamic_symbols): Similarly terminate string table + section. + +[Backport note: Adapted for binutils 2.42. The upstream commit targets +a newer codebase that uses _bfd_mmap_readonly_persistent and has an +explicit unterminated-string error path with return NULL. In 2.42 the +code uses _bfd_alloc_and_read with shstrtabsize+1 allocation and +unconditionally null-terminates via shstrtab[shstrtabsize] = '\0'. +Only the shstrtabsize overflow check fix applies here (shstrtabsize + 1 <= 1 +changed to shstrtabsize == 0). The second upstream hunk (DT_STRTAB +error_return -> terminate) does not apply as 2.42 already +unconditionally null-terminates the dynamic string table.] +--- + bfd/elf.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=db856d41004301b3a56438efd957ef5cabb91530] +CVE: CVE-2025-8224 + +Signed-off-by: Jaipaul Cheernam + +diff --git a/bfd/elf.c b/bfd/elf.c +--- a/bfd/elf.c ++++ b/bfd/elf.c +@@ -285,9 +285,7 @@ bfd_elf_get_str_section (bfd *abfd, unsigned int shindex) + offset = i_shdrp[shindex]->sh_offset; + shstrtabsize = i_shdrp[shindex]->sh_size; + +- /* Allocate and clear an extra byte at the end, to prevent crashes +- in case the string table is not terminated. */ +- if (shstrtabsize + 1 <= 1 ++ if (shstrtabsize == 0 + || bfd_seek (abfd, offset, SEEK_SET) != 0 + || (shstrtab = _bfd_alloc_and_read (abfd, shstrtabsize + 1, + shstrtabsize)) == NULL) +-- +2.43.7 From patchwork Wed Aug 12 07:28:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95006 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83EDAC5CFEB for ; Wed, 12 Aug 2026 07:28:43 +0000 (UTC) Received: from AM0PR83CU005.outbound.protection.outlook.com (AM0PR83CU005.outbound.protection.outlook.com [52.101.69.55]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2738.1786519715856385845 for ; Wed, 12 Aug 2026 00:28:36 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=IUEnMOcK; spf=pass (domain: est.tech, ip: 52.101.69.55, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=QGhCO9hhKp6JMW80GxlqZ932D+Pw0qqcmerUNUOG/g/FzefyIlU6TEyN/72cxi0vfvU/8oLusQbrE7qsJAKIBuxvedmoC5MwDg7JYNfwTlMRUt+R8WiGGa28BPYflNs1hKh5asZaGURsAUUtW1xohPz/eEU21b+nhhJ+E0iWUrxOWCa3tLOz2iM03+/hbohsHvlOYbT13I1vbyefyS4cvOX89Hp2BlFaNNxA5vz7oj3MZuw4mXjsCZLBUvNO4RmI/bINz9ZMYdysFTdWMbMvk0+/V6TJObVvheVPra8WQAK0838j8LMcn9OetH8NWNmoKPuvfsqchOUKnDBzQdrmww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xyuUsJEqsvhP5xHD6b1qvzY3mQe5jHxEgC5RWVM1QJA=; b=mZ3VNiehpdp+pnBW6uM+g4drI09oloFwv5t4dLhwiAMXLK9pogXJMeIdefvf6nTK+jde9KA4YZdRMQ7iPjWyldbnxx2JnikTjVfI8ZBre7N6ePLyZJ1/0uUb2LRXTnLtNehDJShE5FDmwchqZeRg+u7e/cEWWuLNpLWxAxKeATSjyQE1fivDmsqfsJKqS5CFcsslS+2a53YcRcM66C9oJ/3G9auIc3rJg0cuGRvKcNaoRNk8Abj6R2bIQ3tjA5yPUEvKXuBTFsu06e+tJfSruxguEmnVMr/Zv+J61w3AbO6aovX4FPcqDii7z8493PU/1AReKDya5eJC/SxOUnW98g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xyuUsJEqsvhP5xHD6b1qvzY3mQe5jHxEgC5RWVM1QJA=; b=IUEnMOcKxDxq7VuibF58E2PzqLx9b892R4nwqwBsa3mEIMdTCK0G5y7Yo6XjpEj6ulq4tZga/NejepOxeo6RwiDNvIN9dFUOPsHk6D0/navjyegJgonXeaB98ruueRr8UY5WatmAQj+kYLPGgAOZTHmRWdrFORSHWkquVUkcjFJlVqVoCTyPYxP7+sv1QOKuCEp+4vehUZ0Ldh5kCV6rVunk/2mSSdm0V8ZnZNCV34HDwJRylG4mlkLOtrA3eJsHY4Ytq8XTPnUiFPYC99jg9rlf0xj9lfzv8lRfPLqtkBPAsbJPjaRtFGqZcUyBvfrLe56XVtEfDkbnt1reECUphg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by BESP189MB3212.EURP189.PROD.OUTLOOK.COM (2603:10a6:b10:f5::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.3; Wed, 12 Aug 2026 07:28:33 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 07:28:33 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH 3/4] binutils: fix CVE-2026-15003 Date: Wed, 12 Aug 2026 09:28:21 +0200 Message-ID: <20260812072822.22227-4-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812072822.22227-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DUZPR01CA0200.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b6::10) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|BESP189MB3212:EE_ X-MS-Office365-Filtering-Correlation-Id: a3a594df-2140-4ec3-b82c-08def84350d8 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|376014|366016|6133799003|56012099006|11063799006|10067099003|3023799007|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: YKilarjVS/jk6bCkwl0T7i69t+09ydLRCzwnAjs3pNfSS0x6YpRj1FkJkpehrxIwnOuArBZeNBDT3VK3bp+NUG5z1gyFXK98bMGMZPat7/b0TeUboOCal1LGztNYjk6epxvWXOdv7QtClhNfai9DUBbHyTyfwSc7K134qgFgQ3Mag/8Jwd39dhD5ppjRgW3wvvbWBFlwSPF4+ge3iwdpW213dV7tiG+u+zK1g4mCuM0Sco3yQ/i8Ov6cPmWUINoR/OdR8mlN5VemlBgBrddoaJa4Sl5Xi+lLYnykLlBH24oewgX6gulunvcx67cXWz4p0+WSvWlPN5r4cXrpxptFZER8POqQr9RxbHiYDMUKaIyE3o2G1XGTlf0I9Fmcz341HFtTeYzAMe3Q3tXd+ijjhF9OAHwZcjWDq4CvRHP3qWJpBC2TjRfAQjeYNbQD8/wT1fMk5oW2zMqEEdos+TjFFNJAoCH/8tw7sNDjTJvw9U4pB5+sWFg1GIsvq2f0Ke6ATVyMGtPNcZ1LT+aJYVrVpgjsUhmWVzr7qoWQHlua47wZ6elEZ8bPXzvhmBeXNdi1pTvTEO0GvkkY+yHyVq4MtX/0F9oj2t30C9CRmjZ5G8HmWMNmn0eIUaZvY9K4rpWU X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(376014)(366016)(6133799003)(56012099006)(11063799006)(10067099003)(3023799007)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: U+gNjYAPRIaALu9N7dkBvOt+qtm5qRqptOoV0eqHSG1a6Ococ+AdIKlG7e8I5g+v1X5Per2iWy+BuivqqGBpCmTbdrFop5peAELh8vQDuzyZS/p5kzlJd+7EeFDFUPd8SzZXoWFGDfUubggMVj+ToN+xoKEwiefcL52faffeeefIIGrEuoAqL66amIt6jsePca9+qlfaEljrQH1XzmfhV1TNc11FGUkhd4TIiv3+PYctdWMuyigpV/c4hhtgFO7PNMNsLgbkI5SbbNWzD8xaMq5NR2GdH7oyf3UWedI8VW4lcRQUPsvUPc0reKQhhOoU1531mgCboOXAnGQCIkXNSnuDsCIvNjsUNUiqP2g3dk7MjX/58CGefGnrptm2iU+jIPdja8brU13S7FDD2DE6s0E8pcPrdIMnMk8TORNlqxOP2wsr/5cPi0UeSDZHkPI2/RGr3quNieEGhYE/AKtpn9pPH9S4k5kkAWSjOu+o6OHWTSEcWWcH/V56YnGuv35/pxCDJH1aRprWy1SLgn/wGQQjG5/d4uZqD5FJSLoaqgBebPauHkgoBMT0Y4uqzrA6bUzUTOdje1YXLmoJLqhoPN18kqfSWWqX4RYJnMSVemNOqaAph5kJrCyD4GbOEEsEDUTnLZZr7NDdjrsVBrRS5v0QxTgXg5YRnsRYEcLnBxeQ8aBlMPKU80RhKHftcWngeDwFzgb6kpxXV/kcr7CELvLpIDH6pepKCqXCPwztcl6aA27N32CxZX+QagRPKdvifO28WcOVLafVP+19ymHsY1N1Br0HOyBbnhlsrPPiju2aUjGfvjLadYwf3vjFZGDfSTB4MzRKSSm+jV8/uOl1FoK3CJNt46zxwxqStxO44K4BoJrSjZS1zS/Uua72lMwlKzih8hBDN+Hva3UenzTjVQOIw0pq3FIqIQ5UKe90yulWx9q/XZQ83Jzu9wwEs+U+3Hoenl3R+1ZcHQtHvFniMHTKRlLCL4MOq8a+rNhKvriBJa0+7s6dcb+B+QRXsgSzYSJHQGCo2ho+mBvsv9uyWe9yL+cI+3TKNoimVdh/Z6EcdAPar7GRPG2cX16ad5ypWolLxD1bGQp5n+A3DE+wE046Ew7BquZtm4kp74DZ+lQAhdC4tQXCgIEx0TaKYyAGPslonoeFUVBrgXNdEht9MXR7CtX/iIgrL/dwhTK1vEUdVzw4jjzFy0aqsp3A6C1BiFkbbmitPpRFdbFjSXadmJWd0cPh+lbzjRehR7f2z3E35kO/xuAE9vaKdJGuZkSAvImofaBvioKo+4iyVraRbErKe8OPLT4Yox+y1cy3sAQa2efTLSn2ddghKFgUc+5b9bmKWE06Z3+dpRPZzv7BEBMUv0WcOr/XmcuccBJTyDrnliB7peMPua/6BUic/5Jx14R0mTpYxfhE934EvJ704/mS8WyXRyjKrhptdb80JKKqSdCMTAWPOQ/jNKcIkYw9eUlO43J4dVhmrowCX249akyuOq2o7L4Xso/PYHQsgF1sECIIwL7yzNwam4Yua4njkHlUBfW+5GIGuIHvVV2Ryq0LTYilVzOsYrF0LgeptnIGcOF46/ZhCi91bgToHqYRB/rrrWEG0IwyZGYckLwwAAlSMD7ZkLHlulMXvO8nGAVny4hw3XwNR8vow7+MjMj6Ma9NnYdN5cVlqoyy0GFh7/3yLu7y5MwP6mQwnEJVolTsnIiBwhQLkMzPhu8rbLl8fZmtye+FW5KY+Mb/G7Xi3jgtP+1CMhUDy4yfUgKsWJc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: a3a594df-2140-4ec3-b82c-08def84350d8 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 07:28:33.7753 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ZJGjuWlsvjkPj9s5sBK6IgQMLgi6LrZTqibeNMB2AWoso8k/F4l3Zq5AOmfdYmvoueBqz+3wEsLxU2h7c7KWJufZz8FhCw0y+S2U1Td2Ge0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESP189MB3212 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 07:28:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243250 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-15003 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=23acf2f003f81b2f8d9d1997ea45d822d33d386c Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2026-15003.patch | 400 ++++++++++++++++++ 2 files changed, 401 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index 5534ce577f..447529ffa9 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -80,5 +80,6 @@ SRC_URI = "\ file://CVE-2025-69645.patch \ file://CVE-2025-1147.patch \ file://CVE-2025-8224.patch \ + file://CVE-2026-15003.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch b/meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch new file mode 100644 index 0000000000..47e0e65f2e --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch @@ -0,0 +1,400 @@ +From 23acf2f003f81b2f8d9d1997ea45d822d33d386c Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Thu, 9 Apr 2026 09:06:27 +0930 +Subject: [PATCH] PR 34053 buffer overflow in xcoff_link_add_symbols + +This patch adds two sanity checks with error reporting in +xcoff_link_add_symbols before reading symbol aux entries, add extends +assertions in later functions. A whole lot of unnecessary casts are +also tidied. + + PR 34053 + * xcofflink.c: Remove unnecessary casts throughout. + (xcoff_link_add_symbols): Sanity check aux entries are within + symbol buffer. + (bfd_xcoff_build_dynamic_sections): Assert the above is true. + (xcoff_link_input_bfd): Likewise. +--- + bfd/xcofflink.c | 132 +++++++++++++++++++++++------------------------- + 1 file changed, 62 insertions(+), 70 deletions(-) + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=23acf2f003f81b2f8d9d1997ea45d822d33d386c] +CVE: CVE-2026-15003 + +Signed-off-by: Jaipaul Cheernam + +diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c +index 7f1c0df760f..cf3b33e7202 100644 +--- a/bfd/xcofflink.c ++++ b/bfd/xcofflink.c +@@ -371,7 +371,7 @@ _bfd_xcoff_canonicalize_dynamic_symtab (bfd *abfd, asymbol **psyms) + { + char *c; + +- c = bfd_alloc (abfd, (bfd_size_type) SYMNMLEN + 1); ++ c = bfd_alloc (abfd, SYMNMLEN + 1); + if (c == NULL) + return -1; + memcpy (c, ldsym._l._l_name, SYMNMLEN); +@@ -1038,7 +1038,7 @@ xcoff_link_add_dynamic_symbols (bfd *abfd, struct bfd_link_info *info) + { + char *dsnm; + +- dsnm = bfd_malloc ((bfd_size_type) strlen (name) + 2); ++ dsnm = bfd_malloc (strlen (name) + 2); + if (dsnm == NULL) + return false; + dsnm[0] = '.'; +@@ -1081,7 +1081,7 @@ xcoff_link_add_dynamic_symbols (bfd *abfd, struct bfd_link_info *info) + coff_section_data (abfd, lsec)->contents = NULL; + + /* Record this file in the import files. */ +- n = bfd_alloc (abfd, (bfd_size_type) sizeof (struct xcoff_import_file)); ++ n = bfd_alloc (abfd, sizeof (*n)); + if (n == NULL) + return false; + n->next = NULL; +@@ -1477,7 +1477,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + bfd_vma value; + struct xcoff_link_hash_entry *set_toc; + +- bfd_coff_swap_sym_in (abfd, (void *) esym, (void *) &sym); ++ bfd_coff_swap_sym_in (abfd, esym, &sym); + + /* In this pass we are only interested in symbols with csect + information. */ +@@ -1523,9 +1523,12 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + { + union internal_auxent auxlin; + +- bfd_coff_swap_aux_in (abfd, (void *) (esym + symesz), ++ if (symesz >= (size_t) (esym_end - esym)) ++ goto badaux; ++ ++ bfd_coff_swap_aux_in (abfd, esym + symesz, + sym.n_type, sym.n_sclass, +- 0, sym.n_numaux, (void *) &auxlin); ++ 0, sym.n_numaux, &auxlin); + + if (auxlin.x_sym.x_fcnary.x_fcn.x_lnnoptr != 0) + { +@@ -1552,7 +1555,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + + linpstart = (reloc_info[enclosing->target_index].linenos + + linoff); +- bfd_coff_swap_lineno_in (abfd, (void *) linpstart, (void *) &lin); ++ bfd_coff_swap_lineno_in (abfd, linpstart, &lin); + if (lin.l_lnno == 0 + && ((bfd_size_type) lin.l_addr.l_symndx + == ((esym +@@ -1567,8 +1570,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + linp < linpend; + linp += linesz) + { +- bfd_coff_swap_lineno_in (abfd, (void *) linp, +- (void *) &lin); ++ bfd_coff_swap_lineno_in (abfd, linp, &lin); + if (lin.l_lnno == 0) + break; + } +@@ -1589,21 +1591,21 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + visibility = sym.n_type & SYM_V_MASK; + + /* Pick up the csect auxiliary information. */ +- if (sym.n_numaux == 0) ++ if (sym.n_numaux < 1 ++ || sym.n_numaux * symesz >= (size_t) (esym_end - esym)) + { ++ badaux: + _bfd_error_handler + /* xgettext:c-format */ +- (_("%pB: class %d symbol `%s' has no aux entries"), ++ (_("%pB: class %d symbol '%s' has missing aux entries"), + abfd, sym.n_sclass, name); + bfd_set_error (bfd_error_bad_value); + goto error_return; + } + +- bfd_coff_swap_aux_in (abfd, +- (void *) (esym + symesz * sym.n_numaux), ++ bfd_coff_swap_aux_in (abfd, esym + symesz * sym.n_numaux, + sym.n_type, sym.n_sclass, +- sym.n_numaux - 1, sym.n_numaux, +- (void *) &aux); ++ sym.n_numaux - 1, sym.n_numaux, &aux); + + smtyp = SMTYP_SMTYP (aux.x_csect.x_smtyp); + +@@ -1726,7 +1728,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + + erelsym = ((bfd_byte *) obj_coff_external_syms (abfd) + + rel->r_symndx * symesz); +- bfd_coff_swap_sym_in (abfd, (void *) erelsym, (void *) &relsym); ++ bfd_coff_swap_sym_in (abfd, erelsym, &relsym); + if (EXTERN_SYM_P (relsym.n_sclass)) + { + const char *relname; +@@ -2507,7 +2509,7 @@ xcoff_link_check_ar_symbols (bfd *abfd, + { + struct internal_syment sym; + +- bfd_coff_swap_sym_in (abfd, (void *) esym, (void *) &sym); ++ bfd_coff_swap_sym_in (abfd, esym, &sym); + esym += (sym.n_numaux + 1) * symesz; + + if (EXTERN_SYM_P (sym.n_sclass) && sym.n_scnum != N_UNDEF) +@@ -4005,7 +4007,7 @@ bfd_xcoff_size_dynamic_sections (bfd *output_bfd, + return true; + + xcoff_link_hash_traverse (xcoff_hash_table (info), xcoff_post_gc_symbol, +- (void *) ldinfo); ++ ldinfo); + if (ldinfo->failed) + goto error_return; + +@@ -4216,7 +4218,8 @@ bfd_xcoff_build_dynamic_sections (bfd *output_bfd, + /* Read in the csect information, if any. */ + if (CSECT_SYM_P (sym.n_sclass)) + { +- BFD_ASSERT (sym.n_numaux > 0); ++ BFD_ASSERT (sym.n_numaux > 0 ++ && symesz * sym.n_numaux < (size_t) (esymend - esym)); + bfd_coff_swap_aux_in (sub, esym + symesz * sym.n_numaux, + sym.n_type, sym.n_sclass, + sym.n_numaux - 1, sym.n_numaux, &aux); +@@ -4307,7 +4310,7 @@ bfd_xcoff_link_generate_rtinit (bfd *abfd, + { + struct bfd_in_memory *bim; + +- bim = bfd_malloc ((bfd_size_type) sizeof (* bim)); ++ bim = bfd_malloc (sizeof (*bim)); + if (bim == NULL) + return false; + +@@ -4316,7 +4319,7 @@ bfd_xcoff_link_generate_rtinit (bfd *abfd, + + abfd->link.next = 0; + abfd->format = bfd_object; +- abfd->iostream = (void *) bim; ++ abfd->iostream = bim; + abfd->flags = BFD_IN_MEMORY; + abfd->iovec = &_bfd_memory_iovec; + abfd->direction = write_direction; +@@ -4876,8 +4879,8 @@ bfd_xcoff_size_stubs (struct bfd_link_info *info) + } + + bfd_coff_swap_sym_in (input_bfd, +- (void *) esyms + irel->r_symndx * symesz, +- (void *) &sym); ++ esyms + irel->r_symndx * symesz, ++ &sym); + + sym_sec = xcoff_data (input_bfd)->csects[irel->r_symndx]; + sym_value = sym.n_value - sym_sec->vma; +@@ -5250,17 +5253,16 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + int smtyp = 0; + int add; + +- bfd_coff_swap_sym_in (input_bfd, (void *) esym, (void *) isymp); ++ bfd_coff_swap_sym_in (input_bfd, esym, isymp); + + /* Read in the csect information, if any. */ + if (CSECT_SYM_P (isymp->n_sclass)) + { +- BFD_ASSERT (isymp->n_numaux > 0); +- bfd_coff_swap_aux_in (input_bfd, +- (void *) (esym + isymesz * isymp->n_numaux), ++ BFD_ASSERT (isymp->n_numaux > 0 ++ && isymesz * isymp->n_numaux < (size_t) (esym_end - esym)); ++ bfd_coff_swap_aux_in (input_bfd, esym + isymesz * isymp->n_numaux, + isymp->n_type, isymp->n_sclass, +- isymp->n_numaux - 1, isymp->n_numaux, +- (void *) &aux); ++ isymp->n_numaux - 1, isymp->n_numaux, &aux); + + smtyp = SMTYP_SMTYP (aux.x_csect.x_smtyp); + } +@@ -5475,12 +5477,10 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + if ((bfd_size_type) flinfo->last_file_index >= syment_base) + { + /* The last C_FILE symbol is in this input file. */ +- bfd_coff_swap_sym_out (output_bfd, +- (void *) &flinfo->last_file, +- (void *) (flinfo->outsyms +- + ((flinfo->last_file_index +- - syment_base) +- * osymesz))); ++ bfd_coff_swap_sym_out ++ (output_bfd, &flinfo->last_file, ++ flinfo->outsyms + (flinfo->last_file_index ++ - syment_base) * osymesz); + } + else + { +@@ -5489,9 +5489,8 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + borrow *outsym temporarily. */ + file_ptr pos; + +- bfd_coff_swap_sym_out (output_bfd, +- (void *) &flinfo->last_file, +- (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &flinfo->last_file, ++ outsym); + + pos = obj_sym_filepos (output_bfd); + pos += flinfo->last_file_index * osymesz; +@@ -5557,7 +5556,7 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + } + + /* Output the symbol. */ +- bfd_coff_swap_sym_out (output_bfd, (void *) &isym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &isym, outsym); + + esym += isymesz; + outsym += osymesz; +@@ -5566,9 +5565,9 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + { + union internal_auxent aux; + +- bfd_coff_swap_aux_in (input_bfd, (void *) esym, isymp->n_type, +- isymp->n_sclass, i, isymp->n_numaux, +- (void *) &aux); ++ bfd_coff_swap_aux_in (input_bfd, esym, ++ isymp->n_type, isymp->n_sclass, i, ++ isymp->n_numaux, &aux); + + if (isymp->n_sclass == C_FILE) + { +@@ -5796,9 +5795,9 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + } + } + +- bfd_coff_swap_aux_out (output_bfd, (void *) &aux, isymp->n_type, ++ bfd_coff_swap_aux_out (output_bfd, &aux, isymp->n_type, + isymp->n_sclass, i, isymp->n_numaux, +- (void *) outsym); ++ outsym); + outsym += osymesz; + esym += isymesz; + } +@@ -5820,10 +5819,9 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + && (bfd_size_type) flinfo->last_file_index >= syment_base) + { + flinfo->last_file.n_value = output_index; +- bfd_coff_swap_sym_out (output_bfd, (void *) &flinfo->last_file, +- (void *) (flinfo->outsyms +- + ((flinfo->last_file_index - syment_base) +- * osymesz))); ++ bfd_coff_swap_sym_out (output_bfd, &flinfo->last_file, ++ flinfo->outsyms + (flinfo->last_file_index ++ - syment_base) * osymesz); + } + + /* Write the modified symbols to the output file. */ +@@ -6036,16 +6034,13 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + void * auxptr; + union internal_auxent aux; + +- auxptr = ((void *) +- (((bfd_byte *) +- obj_coff_external_syms (input_bfd)) +- + ((r_symndx + is->n_numaux) +- * isymesz))); ++ auxptr = ((bfd_byte *) ++ obj_coff_external_syms (input_bfd) ++ + (r_symndx + is->n_numaux) * isymesz); + bfd_coff_swap_aux_in (input_bfd, auxptr, + is->n_type, is->n_sclass, + is->n_numaux - 1, +- is->n_numaux, +- (void *) &aux); ++ is->n_numaux, &aux); + if (SMTYP_SMTYP (aux.x_csect.x_smtyp) == XTY_SD + && aux.x_csect.x_smclas == XMC_TC0) + indx = flinfo->toc_symindx; +@@ -6564,12 +6559,12 @@ xcoff_write_global_symbol (struct bfd_hash_entry *bh, void * inf) + irsym.n_type = T_NULL; + irsym.n_numaux = 1; + +- bfd_coff_swap_sym_out (output_bfd, (void *) &irsym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &irsym, outsym); + outsym += bfd_coff_symesz (output_bfd); + + /* Note : iraux is initialized above. */ +- bfd_coff_swap_aux_out (output_bfd, (void *) &iraux, T_NULL, C_HIDEXT, +- 0, 1, (void *) outsym); ++ bfd_coff_swap_aux_out (output_bfd, &iraux, T_NULL, C_HIDEXT, ++ 0, 1, outsym); + outsym += bfd_coff_auxesz (output_bfd); + + if (h->indx >= 0) +@@ -6807,12 +6802,11 @@ xcoff_write_global_symbol (struct bfd_hash_entry *bh, void * inf) + isym.n_type = T_NULL; + isym.n_numaux = 1; + +- bfd_coff_swap_sym_out (output_bfd, (void *) &isym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &isym, outsym); + outsym += bfd_coff_symesz (output_bfd); + + aux.x_csect.x_smclas = h->smclas; +- bfd_coff_swap_aux_out (output_bfd, (void *) &aux, T_NULL, isym.n_sclass, 0, 1, +- (void *) outsym); ++ bfd_coff_swap_aux_out (output_bfd, &aux, T_NULL, isym.n_sclass, 0, 1, outsym); + outsym += bfd_coff_auxesz (output_bfd); + + if ((h->root.type == bfd_link_hash_defined +@@ -6827,13 +6821,12 @@ xcoff_write_global_symbol (struct bfd_hash_entry *bh, void * inf) + isym.n_sclass = C_WEAKEXT; + else + isym.n_sclass = C_EXT; +- bfd_coff_swap_sym_out (output_bfd, (void *) &isym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &isym, outsym); + outsym += bfd_coff_symesz (output_bfd); + + aux.x_csect.x_smtyp = XTY_LD; + aux.x_csect.x_scnlen.u64 = obj_raw_syment_count (output_bfd); +- bfd_coff_swap_aux_out (output_bfd, (void *) &aux, T_NULL, C_EXT, 0, 1, +- (void *) outsym); ++ bfd_coff_swap_aux_out (output_bfd, &aux, T_NULL, C_EXT, 0, 1, outsym); + outsym += bfd_coff_auxesz (output_bfd); + } + +@@ -6929,8 +6922,8 @@ xcoff_reloc_link_order (bfd *output_bfd, + howto->name, addend, NULL, NULL, (bfd_vma) 0); + break; + } +- ok = bfd_set_section_contents (output_bfd, output_section, (void *) buf, +- (file_ptr) link_order->offset, size); ++ ok = bfd_set_section_contents (output_bfd, output_section, buf, ++ link_order->offset, size); + free (buf); + if (! ok) + return false; +@@ -7395,8 +7388,7 @@ _bfd_xcoff_bfd_final_link (bfd *abfd, struct bfd_link_info *info) + if (flinfo.last_file_index != -1) + { + flinfo.last_file.n_value = -(bfd_vma) 1; +- bfd_coff_swap_sym_out (abfd, (void *) &flinfo.last_file, +- (void *) flinfo.outsyms); ++ bfd_coff_swap_sym_out (abfd, &flinfo.last_file, flinfo.outsyms); + pos = obj_sym_filepos (abfd) + flinfo.last_file_index * symesz; + if (bfd_seek (abfd, pos, SEEK_SET) != 0 + || bfd_write (flinfo.outsyms, symesz, abfd) != symesz) +@@ -7480,7 +7472,7 @@ _bfd_xcoff_bfd_final_link (bfd *abfd, struct bfd_link_info *info) + appear in the symbol table, which is not necessarily by + address. So we sort them here. There may be a better way to + do this. */ +- qsort ((void *) flinfo.section_info[o->target_index].relocs, ++ qsort (flinfo.section_info[o->target_index].relocs, + o->reloc_count, sizeof (struct internal_reloc), + xcoff_sort_relocs); + +@@ -7488,7 +7480,7 @@ _bfd_xcoff_bfd_final_link (bfd *abfd, struct bfd_link_info *info) + irelend = irel + o->reloc_count; + erel = external_relocs; + for (; irel < irelend; irel++, rel_hash++, erel += relsz) +- bfd_coff_swap_reloc_out (abfd, (void *) irel, (void *) erel); ++ bfd_coff_swap_reloc_out (abfd, irel, erel); + + rel_size = relsz * o->reloc_count; + if (bfd_seek (abfd, o->rel_filepos, SEEK_SET) != 0 From patchwork Wed Aug 12 07:28:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95004 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6825BC5B56A for ; Wed, 12 Aug 2026 07:28:43 +0000 (UTC) Received: from OSPPR02CU001.outbound.protection.outlook.com (OSPPR02CU001.outbound.protection.outlook.com [40.107.159.28]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.2741.1786519720345856902 for ; Wed, 12 Aug 2026 00:28:40 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=sh6kCJbQ; spf=pass (domain: est.tech, ip: 40.107.159.28, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MH7YT5MYn7rieBeCOQm3qj+ozYutijiYlg8o4WlsDlbixjikdYj9W2rqA0TwTjtH5qtZJK7xzYaVbygwJOZR+dVXjgglpg4bp3TjmcR0+caaqSGB7fKWYEvMAGavTTfZnMYocsUk+yImD6v7apcYiMRAOjPiQy6nFW5t2T0FCdS22Ju2c75ZQQ14WxiG+2bC/J+VniG2Tjo+UHkSLuvzbintQilTQjN8IK2Ez6gF1Tl1LkCGy0vdrXbMumj8JVX7MzwWjApTR2r+JkZq2CCz6M8jB4UJXnbMYfhai/+A5G/GNI5dXVcpYuSoVhM7WPJdmcARBOUNqe8xFjQd3hDi7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=x8EcuYzM3/fOwNIQNz2j6cPz50KFc+/v1FC08EGBCls=; b=LUYw/rHF3ZHVRA5qddyiSkCQppUhNA9iSDU0H6ZgtcC0dkyO2Po08u2lqZkDIxNtODPo++GxCdnj7A+sMPCUuw1k/J+JIyDrzfGBwqD6X818LuzNxWLKqa4jTYqIl3yMbfyTg39KU1gKg4rq2PrBLZeZnXj4BIUJMUYKOOTkcu71wOUK/m1Ha0+JfQJ2SOyItLscH+6f/56uL5tgdAHKh3zIu5BXUfHFxTpGdxUKT1avlTnr7JR4HON32Fs+QElAE1Ln0gfNH5ka9Ad1sF/bhOM0xiZVPYFp2iAF5ovSL+6jTDCoGy5ckC7FKn50zQW8eZYsz5RiCkloyPoxoTBYoA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=x8EcuYzM3/fOwNIQNz2j6cPz50KFc+/v1FC08EGBCls=; b=sh6kCJbQtZNLu74iC9e+GXSH5Jm5KuZJ1riWUtmYthv4VKALaT74voPZySDJ/vdN0wsBA4GZaKwtQcchMF2Jsb2VDx9gmHAiZEM+dpiiHx33BQRgFKjaoNflrbI2XMham5E8iv6PHTawD790nAM5bObAJPE1oprI6pVo0egrFqToHTuGpg00QDNErz3Gv0zr/wy9rkK7dNsdMse7nztzkUfQzaHxbPEHzG3Vp1x3evHTCtuk7OeTvmS7dKbIrkCI4b8Gra8DbHq9fEwpo0LIWBTAXVkp5B37rkue5iC5VPdouT6LqdidX1apj3VhMSIQvjQvHoy65qtsm3c3tDW3fA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by BESP189MB3212.EURP189.PROD.OUTLOOK.COM (2603:10a6:b10:f5::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.3; Wed, 12 Aug 2026 07:28:36 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 07:28:36 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH 4/4] binutils: fix CVE-2026-18220 Date: Wed, 12 Aug 2026 09:28:22 +0200 Message-ID: <20260812072822.22227-5-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812072822.22227-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU2P250CA0029.EURP250.PROD.OUTLOOK.COM (2603:10a6:10:231::34) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|BESP189MB3212:EE_ X-MS-Office365-Filtering-Correlation-Id: b004b6fe-fd9a-4cc9-64b2-08def843526e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|376014|366016|6133799003|56012099006|11063799006|10067099003|3023799007|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: GIYCTxvZWKWw3XdlFKeeXq+aYAsfFMUAn8LU39y1yWpJzhk95+xdXVuKNDT+XnSD1CdlGfVBTJQnTTDgXtN1WtEmJaOyxcvTDRnaIloIIWYM/LSQlAlrOgSujrtXheaFec3ciyDKtKN8GGRGiyzOPVkVxEDvM5KlX1FgCTkrVpX3BrzzmXXBtn9tJVAsB4CR9NVAr8v/Uu7Cvu3+rv4dBmiI6ryYUkYCVAdp1k2YlEScW4ac/f1E/QKVVbjZwNWO1indkkywLrHn9auXxPhM8D+Fz8KzawD4D0aHj5+6mO2g5hBmbW5eiyeDEVUV5G+JRxRNM0Wm/YdQVIWvqdGXc9qE02hfGhm0XEfLzZK1OAqKTkfOeXfPfYLkaAZjKZlXSzqJwc51JpOudVn06sNwV43vjiwLRSd0l+RbXkvlPiA/UOj4aNstGQLgyFqzPdyu3W9z6zbKRvf7JBdanB5RNUYr4bfb12Q6XKMpvDm7+1eOnpyr/cRM5OlSZlU6tPzbaN8h3ezTJbCSfYocpdhl+Qxe0ztVLOrjEpg3SHeDIXV+kKbsMLYsb2SFeRatH6RUvyb2ENxJZGAesaPJ/WLSZN6ShhPczjnwL9oQZmjXxVRcisvpEbB9JWs5d1r0Bs89 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(376014)(366016)(6133799003)(56012099006)(11063799006)(10067099003)(3023799007)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: V9+PnDhx6B4BRejatt+XheKLLUubV2zsdCe4/Kk3tKYRACJYx7n0JLFwg3yvJo2Do+gWjR0LvU2zJNrdHwU72vetqA6r/wur+X8DPbreWc8RsfRg/nKqwacKrAU4mdcVtOl2XedLvJjZ0GvDppLQhgD6iiFtN4ubBqFtDIGFof3PIfyIprppW2ByS2B/OaIllejO1T8lM7i1v9dPw3KQ6guwvUEFfMJki6JjLHCzBERmvwbYldtzGE3epia8Fszmd8LfOp7Os8LPlnI4nU1gkDb+8QF3wB4RsP1fnSQOsdV4n6sXlbe59JbNU4Yas3/VZN2yFRQ5MAXK05Cjtp9OBSPEGj6x1ruZrkC6ZktiaIkkD0ZWKyOra0KhdSkIx6eMhh6ReZuhDWsGwkAKwLb4XbYZ+hVrBgN/NX76IagHa5JXPjQLTDQIN45CPfOLjNLB1OqI/0CCTW/PFpiWjSO7b8CJ7EKFHOVNnlWqQx4qm/38TTTfddzFMRAkPCyhFAEsjvJwiHNrfVWPsjy3g6Qyi9Yai/5N3CWyMu57IuhFdTcZKc1kRG+rIIpFYVwVQP3efnLM3F7ppeLHxoskVRYzjPCOt4xya9G6vD4pFvlKyomAegONWrfuWLliWD4L+E3WbVNaczhJIlbQxJN+W5v+tDEH89tJn+Z/vSUCotHNs+5ZfV16MTLIX58La53ccRK19EBhpgpDhiR9KZOsDjM+f8rQc8yorT1qu6nahPsk9Oy1aQYivjA4L6PxxcVdUOf4TMj0W8ULGR06HU8VKKUI/SVjb+g4hILT+2vN/RuvgyxiVqX4vSLdXt351FA9gMzIL0kX7n+yq35P8Lj5+qBW9H28SOuolXEScL4rhAPpvDgt++RVCq7GKYAoDCS/xii7xCZYfX6ik28hcvqckDAlHM+EI9tzgS6TVxTGzAvuGalwtQxVMAOlGGrtCNs53Gxvhhd9MQQSIfkFmjvSQuOeh34DGFTGW6UvGnb78RkB8K0Snj33dMfrpM/SjdT82WoOz+soFuoCSmvmTE3oBRWWVKrGp8IwYfUhcDep/TqbBi1Yh0nnCv/cZaVoW0fkJn4AC+wrr/qvdA78l0lg/pNjQ2IjbSrxBOMLkwQ1hkuYNXdBMkee+ESaVcRAwsA/Zpxza8zHvESIcaHLA+/5q//0McbplIPcI0w99SSqYNHmDcji4htvI5q05J3q/x8NdDoQTYmFtk7U5hlVGP2IWoHl6RDlYmgw5b/wNIKN18174h76CpvYGbkUv+aIs1GIECyrjTKL3Yr6pXDeaRsnrPxfjx/ev0M+9H+jVieOotvWHW9DbzJf34knCOZPqteI5zQ1JFs5YOeC1QkRr9Cgy94Eew02x0EDXz30qxQ7tLdG2gtAQwhX3nzSQgSLN0MF2Zom1M2+FM5Ab8QsvjJfJAvg6q8rdeNhBACcka0dkd4c+Zc3uzZtTwWWqAsRXdCTplQ4SUzCuKK11HP1DMV1fQgBbXB/tHAP1UrZPq9xPRsHYvKVJNUYRAhS/351cT13P2Hw4XHOq57sfJjfP2WDza7/Q6qvQW3C5Ax56mEs2jhqE//f04n5L4eqWAYjbmh5i8qddglVRnhRCZdP2i1EXLrjgnRqo3RD0x+thNYqmZ6d+Y0VpFrTzUmjzKer6uiMSHeNSuhlosaihVOowA3yTvgyMF38R0Xo2Bz3rs4XTjLi7PEhBZnNSDayrGRV06HV+MlcA8O2ofxBIzRXw28E/kNdmfhmwGbB5Ig1bknh+fuqwM4= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: b004b6fe-fd9a-4cc9-64b2-08def843526e X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 07:28:36.4208 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 5OaCf7xSEDvZ6hE+77xcmOV6UykF5Ql5NYaj2u1NnTQ0jbMFr+JucNygj9taQgOjgCFxWmv3wTHfaXOy67zgqUiyxMSUVR61PSipGKeD+cg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESP189MB3212 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 07:28:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243251 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-18220 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=114e3aae2b7e34057c8909301eaf78c15687e8e5 Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2026-18220.patch | 65 +++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index 447529ffa9..d395ae1b1e 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -81,5 +81,6 @@ SRC_URI = "\ file://CVE-2025-1147.patch \ file://CVE-2025-8224.patch \ file://CVE-2026-15003.patch \ + file://CVE-2026-18220.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch b/meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch new file mode 100644 index 0000000000..36d4ae28b1 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch @@ -0,0 +1,65 @@ +From 114e3aae2b7e34057c8909301eaf78c15687e8e5 Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Sun, 28 Jun 2026 09:11:46 +0930 +Subject: [PATCH] asan: buffer overflow in elf32_dlx_relocate26 + + * elf32-dlx.c (elf32_dlx_relocate26): Sanity check reloc offset. + (elf32_dlx_relocate16): Likewise. + (_bfd_dlx_elf_hi16_reloc): Likewise, and remove ineffective + existing check. +--- + bfd/elf32-dlx.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=114e3aae2b7e34057c8909301eaf78c15687e8e5] +CVE: CVE-2026-18220 + +Signed-off-by: Jaipaul Cheernam + +diff --git a/bfd/elf32-dlx.c b/bfd/elf32-dlx.c +index 2dfeb4d7390..0f9a49695d7 100644 +--- a/bfd/elf32-dlx.c ++++ b/bfd/elf32-dlx.c +@@ -77,6 +77,10 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd, + return bfd_reloc_ok; + } + ++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, ++ input_section, reloc_entry->address)) ++ return bfd_reloc_outofrange; ++ + ret = bfd_reloc_ok; + + if (bfd_is_und_section (symbol->section) +@@ -89,9 +93,6 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd, + relocation += reloc_entry->addend; + relocation += bfd_get_16 (abfd, (bfd_byte *)data + reloc_entry->address); + +- if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)) +- return bfd_reloc_outofrange; +- + bfd_put_16 (abfd, (short)((relocation >> 16) & 0xFFFF), + (bfd_byte *)data + reloc_entry->address); + +@@ -143,6 +144,10 @@ elf32_dlx_relocate16 (bfd *abfd, + return bfd_reloc_undefined; + } + ++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, ++ input_section, reloc_entry->address)) ++ return bfd_reloc_outofrange; ++ + insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address); + allignment = 1 << (input_section->output_section->alignment_power - 1); + vallo = insn & 0x0000FFFF; +@@ -206,6 +211,10 @@ elf32_dlx_relocate26 (bfd *abfd, + return bfd_reloc_undefined; + } + ++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, ++ input_section, reloc_entry->address)) ++ return bfd_reloc_outofrange; ++ + insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address); + allignment = 1 << (input_section->output_section->alignment_power - 1); + vallo = insn & 0x03FFFFFF;