From patchwork Wed Aug 12 10:54:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95017 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F978C5CFEB for ; Wed, 12 Aug 2026 10:55:04 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.4]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5121.1786532095724458653 for ; Wed, 12 Aug 2026 03:54:57 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=lDRTkJka; spf=pass (domain: est.tech, ip: 40.107.162.4, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YXfLwD8vGEJTL8mc9joGesUt5vfgj6BZPHFKpNpAL7dj1izcyyQNWi52c8yOHdtwWvI/MCCY11ezAFDBk4T48Jk07C40LtqbcpEDKKgvQy1CU5j6RG6/NwOEWxdd9R4pLTTY1kARd7qlCkvMQMWVxQUacIZf8lkyhY/eWIvVV3GMRbyKHgv0Gxcgv9BOg2hTXTG2ky7ShT6i4BRv6nKnsdvD9jHw6KY+mG5d+zGSTYAk4hdgdfi+Pz9FYGzhoKaD3jQH0c5ZDYcqFlnb+IwCrMCXvSe9pkBuMZQWhLkdCAFpDcm68bg/t6To38Tos9e8fMhpkyIHEhL4iTXR5A5IZg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wRTSUyxRe1ExoAXiyyRq5yoTqq5FBasaIInyDPuKebA=; b=TY0cM02gn2WolYv4WHZIWXqqbKJ0F1T3B51PCK3QwAPgdfFEjVyljkkvzDLZBu+rw30g9Ti9HrKWySTwQVjNEa0bnLz4h7r3sQuSaUYZ5ESScX3/EC8j74n1vX/fbC3ST4V2onwwxa/L1JtMOhLfch3oqh6rOcs0BtYKlkO6Vy6IROF17FKByCs7X6N5Pd+6jwP24A4GjaQ9yRbVomRDzQjGL3HsFca2fqAiPQtzK7e8ZrA+NWtj1zd2anEHvHm5raMiQPbsqn+pfX4EE74jz/Iw7+Bx105sa10JgSuwxXiKv6nX+5d9DuiOAaU6F1uqAuUMammR5ecHFea1KTGWhQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wRTSUyxRe1ExoAXiyyRq5yoTqq5FBasaIInyDPuKebA=; b=lDRTkJka+uWjZAttHerXlxRe3eYkd+hNZQiETk0E9uQ28AM79WrFqSGm6RbQofy+4fgCwOt4MIsHvAEBGgFLiZWL9IaTYqwfcrZqmUY4i7Os8l4liGJIaguLaHBvC4aeTNS2JapUCfi427LCiUmeYo3m4ZsQ4eoFCCjj5N7W6rVok59VbScSDNr4htcg+KUw3oaQVMoYdcx2mPN0iZlpf8PFbg9hdiyYooCf5ChMjZTWxu5hKspzHomIbvbHP6OlcN9ZumD2+DFEENG42/zG6ZO1vfyCJnxgtZxRQFh5REZa00gAfJxpomc5D/AVdIndHeOrtTyxmM7es4hDmcEegQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by GV4P189MB3581.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b4::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.11; Wed, 12 Aug 2026 10:54:52 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 10:54:52 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH v2 1/4] binutils: fix CVE-2025-1147 Date: Wed, 12 Aug 2026 12:54:42 +0200 Message-ID: <20260812105445.24234-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812105445.24234-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> <20260812105445.24234-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: LO0P123CA0002.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:354::13) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|GV4P189MB3581:EE_ X-MS-Office365-Filtering-Correlation-Id: 072e09f4-5cf5-4c9c-3d23-08def8602300 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|10067099003|56012099006|11063799006|6133799003|4143699003|3023799007|18002099003|22082099003|13003099007; X-Microsoft-Antispam-Message-Info: CNNm91k64EzzgRdMcEYel01hCFf+r6JRv3bVHsB1/k2slksjouhD3ab3UGXNZ7P7tBc9DsuubdUqHQJ9NDTGIykavJqVFKNg6d2zf1KPbXF9bZjG6Vo7SUj3sN41RzHsMnMtykGKVTAypFx3v6fQaUIDF1XaFqNvSkr5OBnvhVQjxXnwZe+Lv074D21Rs/E559+k2LSGuyWD8OkMcRRC5JT+Qxu23mviZQDb4KFnJWZJZAcVx9oipeHp89mhuMYaKMSIy6T7IWy4kCzYD+bijtSbaaxn+qVb1g0U7I8ULch8q8NvnEHm2lKP1q4y9MuoGnKUiQZAY2XHwQWRqe+3fS+RTk0XsXzliftmMHgCQP7QTUA4P+TBTu/HoE+m+1zbz7mo+r/y2mJCIShAvxnwiMJdsmjXIVVOsgl1lp81NhhK8BTu/xWz/vzVhxhuuldnu9MLcvOrXE95JD0KqSyzK9Hl/R/NDApyJ+lmmUxM9254798199iaK8ulbAkEmpbOA89KWcp5OpHwKyqE0UPdhlXLpM/r7CJRyjRFs4HoCxDlGJ+oRB0WdLbhRax1/SKe3wDYWMPf/N8yRHOcolDAjYdE8NhFUe4ORez5GITgZKEZ0jdSaUh+O/WBM5L2IHp6 X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(10067099003)(56012099006)(11063799006)(6133799003)(4143699003)(3023799007)(18002099003)(22082099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: G80grXjN+RsUCEB1pXf/RXSziX5VdgTE2FanctAkiVEb+RYdDCN6UDW9usx7BZOzdG6eSSBDnu+CESxA7vUo6W4XU8R7Vn6H2OpnmM+8iDedbpmzt6QctHxFeKFiQEHtbbF2mZSXe0/vJiK2YoW3ED0/6TAaXakw0PXD7Kcb1smMrXugo/1mvDYw4M4agXsN5YpAwj2CwLF/owFxcQUTO4v7plStuem5S5JRCvpnNDoSKcR38qZNuV57Kq1RaqAMTlMkWCKEexI43xgSyVQfWj29urD776AzXvsrtPdZ5775jK3jFsWx+hs/ixk6foqUQ1QoxBi3s5rwxlJWL7LrQIv3Nn2BSrThxIyHrZb2c5+pDC577M5K2oLPAL7U7zvSoPQFXfXXrKBpkXy/0tY0QcKMrDhO/fVxALtOGdl1GSNGfk03n7+myUqsCatKVaLJbZx9iS7LSc7MAmdX4B1e+yxpm+k+/0Yp5eNVpXqhvtGZcSoSuFsdxBHCkovv66MopEiQkMdP++cVi3AdBTAxb/Mn9GSZF6q13NES9StIsp8LH8y271cgYD59pwty5XB9L0tiSo0ABH6lSoPjA/lq1ns/0cHDH1WQ2ECXIHMxSl7WGYQ5Xf+aNe+K+XY1oYq3BT4dZXVkg0xi4Ec0nC4MvLvTUaN05hD/x7Qil/i2K6Raw8nFIlLpI5VjoIZcKvFLNy7LHegfHK1CDrXRoFqNdltItduOES9JMjfpw/khBLPkr/tKz8Z9SjHbBZO/1Qf6IEGpwpjeckmXN7Uk98cA/BDOiYXB46hiqkpG83tJSlpwHMEcWQm87+9bxZtxHhpeK34E0ytL7mVNJoX03SFwmcRFKjECxpEotC7KJgrF3dzSF4xDk6Vh2HhrJv+z/paqX2zxnFwX8T7lQnK8X5oxgWiUZBzxbfZvzGdTSg/X/ucIGJDE9ANRHIdztbnHa6NNQpwHPHLSwCkVB9UfkGWQuEFtp8OZakOAylb9n7sAgDe+itC/iW4nhnplWQswaixXYmYQzgAFP0B8WNVjW3XUZL6+wk200hG+gODjmR17LtDq4yKd4CA7Y/JPNJtt/wrAcP//ZKQLbn2zZwal40BHEKpzkSIhiPyOJyTKMRHqJf9zyhiixf66cmf+WQwjWaMHjlvqZSYrVnU8ZwOqtkxNp1uiyYsc4ATq22Api1fi0OIsnIRuUtzjQBR+tn3fiO0r1H/nmRfhn+bI9O/LdWYR0F84qhzeie1E5vr9htWMf0WsnGrSOVyHRWxuCTuSLsl4loYJB/ahvQnkg0E6UBUz1/QESDU4SyAeOx/5OqK10ZAuMDVcVBDQBUBQVhgmnEljlGk/wXszqBZCgK3CHTGWhm7wGwUXs7GiqYOrH3HnzxWT796KeC7w+ZNUzYzMZSFe8RORZY5ZwFshRxG1mCID2SwOIZU3ZvmEhAlTmFopZzN5jQX11FNBRhFELR7O4TOikmPkyCecmD7czoctj/NzzGgRNoXwYz26319sTRKYw6fLiaxx2gWm6qoPAHbl0RrTsdrK4fA3AGUGoCG+AKNsh/E1ORWT5n5ICKQfpyRTM8BmQvZIJRuLx/RJ3MIl+9dEU6EZ5sr3eK59OY7SNmyHUC4n9TEgkVSPOQ/JASbadvNEkHg8j2jasdXjIn0lQu4zQ5d5mR3eaedGAHOf3rocNJuolU2ivjjw6TvW6Pxw4OiG5zYGN3RS3czFYcdntHYclSpbVzCYkuLeZ+e+TWR76juj2Eu2P5gX6LpDBZfCXT8= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 072e09f4-5cf5-4c9c-3d23-08def8602300 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 10:54:52.2112 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: BrLIV2pgBqYQdXNFN8AuJTe/hzgIi3RXC+O6O5LPe4HuaH7lMfg2ZZS20PvWiQ+Jkq9eG9t8F/xNpcjiEMT+3oywTqSRG8uL5FfzE9/rvC4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3581 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 10:55:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243272 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-1147 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=7be4186c22f89a87fff048c28910f5d26a0f61ce Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported (+2 new passes from nm --ifunc-chars=-- tests) gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=7be4186c22f89a87fff048c28910f5d26a0f61ce] Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2025-1147.patch | 110 ++++++++++++++++++ 2 files changed, 111 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index d455acd786..063c6cc2a4 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -78,5 +78,6 @@ SRC_URI = "\ file://CVE-2025-69652.patch \ file://CVE-2026-6846.patch \ file://CVE-2025-69645.patch \ + file://CVE-2025-1147.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch new file mode 100644 index 0000000000..9a95775d3f --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1147.patch @@ -0,0 +1,110 @@ +From 7be4186c22f89a87fff048c28910f5d26a0f61ce Mon Sep 17 00:00:00 2001 +From: Dmitry Klochkov +Date: Tue, 9 Sep 2025 12:06:25 +0200 +Subject: [PATCH] nm: fix treating an ifunc symbol as a stab if + '--ifunc-chars=--' is given + +If an ifunc symbol is processed in print_symbol(), a 'type' field of a +'syminfo' structure is set to any character specified by a user with an +'--ifunc-chars' option. But afterwards the 'type' field is used to +check whether a symbol is a stab in print_symbol_info_{bsd,sysv}() +functions in order to print additional stab related data. If the 'type' +field equals '-', a symbol is treated as a stab. If '--ifunc-chars=--' +is given, all ifunc symbols will be treated as stab symbols and +uninitialized stab related fields of the 'syminfo' structure will be +printed which can lead to segmentation fault. + +To fix this, check if a symbol is a stab before override the 'type' +field. Also, add a test case for this fix. + + PR binutils/32556 + * nm.c (extended_symbol_info): Add is_stab. + (print_symbol): Check if a symbol is a stab. + (print_symbol_info_bsd): Use info->is_stab. + (print_symbol_info_sysv): Use info->is_stab. + * testsuite/binutils-all/nm.exp: Test nm --ifunc-chars=--. + +Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=32556 +Fixes: e6f6aa8d184 ("Add option to nm to change the characters displayed for ifunc symbols") +Signed-off-by: Dmitry Klochkov + +CVE: CVE-2025-1147 +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=7be4186c22f89a87fff048c28910f5d26a0f61ce] + +Signed-off-by: Jaipaul Cheernam +--- + binutils/nm.c | 10 +++++++--- + binutils/testsuite/binutils-all/nm.exp | 17 +++++++++++++++++ + 2 files changed, 24 insertions(+), 3 deletions(-) + +diff --git a/binutils/nm.c b/binutils/nm.c +index dce9207f44f..c3d118a93c3 100644 +--- a/binutils/nm.c ++++ b/binutils/nm.c +@@ -70,6 +70,7 @@ struct extended_symbol_info + bfd_vma ssize; + elf_symbol_type *elfinfo; + coff_symbol_type *coffinfo; ++ bool is_stab; + /* FIXME: We should add more fields for Type, Line, Section. */ + }; + #define SYM_VALUE(sym) (sym->sinfo->value) +@@ -1208,8 +1209,11 @@ print_symbol (bfd * abfd, + + bfd_get_symbol_info (abfd, sym, &syminfo); + ++ info.is_stab = false; ++ if (syminfo.type == '-') ++ info.is_stab = true; + /* PR 22967 - Distinguish between local and global ifunc symbols. */ +- if (syminfo.type == 'i' ++ else if (syminfo.type == 'i' + && sym->flags & BSF_GNU_INDIRECT_FUNCTION) + { + if (ifunc_type_chars == NULL || ifunc_type_chars[0] == 0) +@@ -1873,7 +1877,7 @@ print_symbol_info_bsd (struct extended_symbol_info *info, bfd *abfd) + + printf (" %c", SYM_TYPE (info)); + +- if (SYM_TYPE (info) == '-') ++ if (info->is_stab) + { + /* A stab. */ + printf (" "); +@@ -1902,7 +1906,7 @@ print_symbol_info_sysv (struct extended_symbol_info *info, bfd *abfd) + + printf ("| %c |", SYM_TYPE (info)); + +- if (SYM_TYPE (info) == '-') ++ if (info->is_stab) + { + /* A stab. */ + printf ("%18s| ", SYM_STAB_NAME (info)); /* (C) Type. */ +diff --git a/binutils/testsuite/binutils-all/nm.exp b/binutils/testsuite/binutils-all/nm.exp +index fea68bf76bc..1feb8578fba 100644 +--- a/binutils/testsuite/binutils-all/nm.exp ++++ b/binutils/testsuite/binutils-all/nm.exp +@@ -329,6 +329,23 @@ if [is_elf_format] { + fail "$testname (local ifunc)" + } + ++ # PR 32556 ++ # Test nm --ifunc-chars=-- ++ ++ set got [binutils_run $NM "$NMFLAGS --ifunc-chars=-- $tmpfile"] ++ ++ if [regexp -line "^\\S+ - global_foo$" $got] then { ++ pass "$testname=-- (global ifunc)" ++ } else { ++ fail "$testname=-- (global ifunc)" ++ } ++ ++ if [regexp -line "^\\S+ - local_foo$" $got] then { ++ pass "$testname=-- (local ifunc)" ++ } else { ++ fail "$testname=-- (local ifunc)" ++ } ++ + if { $verbose < 1 } { + remote_file host delete "tmpdir/ifunc.o" + } From patchwork Wed Aug 12 10:54:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95016 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF08BC5CFDB for ; Wed, 12 Aug 2026 10:55:03 +0000 (UTC) Received: from PA4PR04CU001.outbound.protection.outlook.com (PA4PR04CU001.outbound.protection.outlook.com [40.107.162.4]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5121.1786532095724458653 for ; Wed, 12 Aug 2026 03:54:57 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=vefwWANn; spf=pass (domain: est.tech, ip: 40.107.162.4, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MQ7+kry0sNR/ArdqIZWV6YBPS3HafWfhkXGzfNVw+KXj5C/b6xRUMxwzZukDfzOIXTF6fuUThcmnDaJs9ctUxtj55Hi/9zLf9MpZFBNDPnFflLtIXMfrhOiHrjuKktiNbpNDC90hxe+HjHaY2kdAGxH96Fy7vjKmPU0Ge8IrYHJPbpcacOn0lqEHTwdhUnYsn7PcF++KSErqZyCoMiaMdGeu8R5ekScPiCQfpAEGhjyKYivKvAkvd4tq9Uw/59J6A8jmeY6XzNV7Pk7AYJyY8K+8SresWpMlg+uNYIn9yzAbd5Uklgwkcr8WGoNHpsuvJRYQLgXWB4S9MOi0ztBgDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=uvQKDsLWRD0W3UDGOCq0Nr8jdgQWede8TPpxnWi5y0U=; b=TsqtAW7/9sRY3LvqYi78cXfL6qJSVcF7nwODLhGT6zVThFq0yGFpBpIXxCrTyLykGnYwV14iqHnJtGQUyfhmhNgLyH9nu+qJU5wDVJu9DWRvwzYOsbjEs6YhS6py6GUO1RevoGM74/UVNqaUOWDBr2QLV2SufW1laYpRtgcFiIxwYkjWRNg6Z1sQ0h6dWGt+P3j5bm8+5pth6MeLTzPxZBd600VAVIJoyYVpuIO3wkmeNGZeRLKx7nso2cuW0wyKbNK6CyJ0Mj4Llpl4GkVEvufyLrCpkGGC3su9+bnNw1jCy2afJtX/5QAgBPfvOy5RGES5HZdKULirANQwKSuiuQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uvQKDsLWRD0W3UDGOCq0Nr8jdgQWede8TPpxnWi5y0U=; b=vefwWANn61i7qs7K5tj4kL7ZsOYCx5v0Erx6mBXNsbzfkcVHpEnaAylXALrGaGeUrmNi0mmYldrrNjj3rDEosv+RJS0gvBIqo4YaTwe4KMLAmx9+sVOIJwIIWDcHiajBEMl7EBTzkojp7A/X2/bkcLZMAS4ocfD2MsWvbPyr0lIrAGKLuAysk+4xfGN7zeRXqbGJc337OS5yM+BGRNf8Wk25E//rNZ78falNl6/JR6/VACxgcl97pSjYza/S7XX+nhk6PFRHoEvQ31LToL/2yr8RN2NAzeREspawplaNagBcET46kIYrUXqfCwIeFCR6Y75VANjijgzwVR+yM4ibHA== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by GV4P189MB3581.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b4::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.11; Wed, 12 Aug 2026 10:54:54 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 10:54:54 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH v2 2/4] binutils: fix CVE-2025-8224 Date: Wed, 12 Aug 2026 12:54:43 +0200 Message-ID: <20260812105445.24234-3-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812105445.24234-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> <20260812105445.24234-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: LO4P265CA0140.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:2c4::13) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|GV4P189MB3581:EE_ X-MS-Office365-Filtering-Correlation-Id: 03d70453-0ec9-49c2-2c12-08def860240e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|10067099003|56012099006|11063799006|6133799003|4143699003|18002099003|22082099003|13003099007; X-Microsoft-Antispam-Message-Info: 4Tv8AuqbL11YIEE8RSP6oaXPFJZGRoHJy8vZttyEZtRf6u/XKoSCtbDcZcdg4R5OIOvGXbG5GlaqTeosTEoxNir0Nlil6Z4HXKOVA737pN1YaQmA4U4vAJ3RniPknxkTj5OiwE6KqHhKzukXD25m3GAosOo5HtqZuhy/K+F8Y9EwRLJC9gqX+qVcgXNBSdrvzyO9KKYdU5mvyh99A6Kg3SU4xR2otuw2AvcbZk4rAI8jt2a6CrDiitn/NJBB31SA7juwWuc/Xm6pYiulpzaCEbrEhEx9NYy4Yp8kKhO72DqX9cAFzmHzoEKCDgBoCxrJlc4Q/VSKHwd91ph9CmwOlL29BvTxFYWtHOOv97LJyQNSynpWhPva+FyxSkenXJWXPaoYOXns6tDZ3srqS56dtjpSFIQ8ZSNbB4KfXlB0BcMWHwF+LqPFA6N2p+hpKEE1q3dm5oD2tWUxeF0DDEOv/sb2l0r0v42i+v41Y7rpqdh9bHSMSSP/HhPn+I0/7Mhyxw9HYUMym08rthORzI8jEdpJp2zIGg7kOAlJ9SRq9dij+evOVHc8Xi4f4TRapd04lviXYGtuFIKN6xkdAfJuJE7Dy9Nb7MYN9dVeVcguVQ0Otyq7/r1O+yd9mhasROqM X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(10067099003)(56012099006)(11063799006)(6133799003)(4143699003)(18002099003)(22082099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 56JBVuNYI/8CW12gWeu8La6WQGVkN4Tn/G+52iQ+R4s1ilEEyFmeip3vbQp8p9Qp/ecKs7kdXSy1Z9eh+yHXOMRlZBBPZ1nsU2uG043RGB71DjH9uqkpRmCoK2Kzcqs9GH6rUtNxnGoRZKgDSgZWxi6W8JDZspFTOm386Gu+iUHWKYCKWzURKEnHrpOMw+Dyq66T1WE2KlZTcWjXuPsnA8XFUEMAFYoeWzuX0H3m5b9MEfk0s7V5OCdxVHMUwZUwabXH6mRZUlSABwbNtemoht+R7Ki40tvzrLC0UEgCYT3WXWKTta5ub1YiZJT0Zkw/3N0k1B5Nt2nsOAUSRPDJIeIRKz6Vv/6KIKUeV9DWxQnT5UC7SoplMHNelzc5yhsKFuKDg7YufFyVi9fjdQkqRjmPjXfg7mBFz647VH0JcO0M+JpUUY8D4jDV05w023g5rvklCCAhWRCXMFmYxD/lHKMwrcNjE4LkM5PGNSg5R9KjNb/kGZCHrpvBU2+BpXM2O3fXADPCoSt15ceEKYttiX0p5TGGTlSu3nl9AJUVV1AGfUODup2PBT+0GztN/7ZXb3TLDhLdVdmilRTlWZuJRtMUJKQXORReFpX0CmQFL1Ej3jxeQXu1jKSaB2YBYTKBppfqp+vj0DjqVWVHDDcUf2NezYloA+EUoiEwNtncrwuG2+fbsSKUptVvHZTHgjlI5sq0Tao6FzCbRcY0JrBLgyTJfOoAWz3uzNpk7D29GcXCsl2OOpGSFYZ2vOeskjWl2zfTxEw0nQJAw+OjSV0AYZ9YpqYIkmuIazFFBforUxP+em+kJzNGUmL39aWxhICBvk8gduVtmtXNSoAsF5LIJMz2ILevUY15JWnx61gTE465ogQDvvi+ZBxYdxiU55VgFyFXL0qygS/wqjaY+oKFXaa0oa9trqJFm8bNhp7E4IRuUalDKNi9fyG0O6p+t6fraFdgUugCXYv5YTJ5sf4N7S+1vHtV1MbRgYuzuGkiFApfWgBaRYs8pJA7CVEjbr9HGmD7ye5dxNNC84Ok//0NH+KSxzcP6wAuRiFsvEGLwTjnOXrGb3ELpSamRbfW1Wzi+aFSfvJruR1we8ADpgFVpX5QgSBU2aIp6NfyKjE3TDjEt2gFZu5iYA1b5nrRRctzbh9G74Vuc3Zeo3SzMjaqxt6DhrYXYKEe3XFhzlGQH4EAp3til5vLCX0S2jwnzdOiUpMM7UCrN/aFVh5WFh8mFuE8fjeK2NJa4JjayJ5GNGhddOOhVp9JxObUK196aeDZHku/r0cZh0ARhklnqHzg+woUubzP2nTa2gehGhL/fD4eqtyytbvGdddjyHlGAMc4D2thSRiZF5/jqKY9jJqpp/kT8UxZctLKgeObtouq/GJMehZAV95orcp6hSPrAr8GM/o9yLITxs6ZRCamBtd9toMq8v5/91Fa6/0awVMKuOzUFuQNeZOoDwRtuTSecW9azKSnTbLibvGqP7lGHEyV524D5d3g9R5ryF3aa37RFATC9R5HODLSQW7faBvvHh7yj/Z6OV2gux32PJzSnUHa+Yqaia1hwmwGK+7YJABhd78HCNGyWpaOqV4qkUaXCdmui0ymvukQDnHGJ7I75gChD/lE8UJYcrjLHl3bvwWwVJE8tNfcp8jLlce0bgwZXFf/lxMGE1YBv47hUw9ND2M55SQXxnl+12cNbFj2jt+g553OSAr8CN1mpCPbBHst8n8ClUTGd/QeRLplSfu3HEv3jwxggJ7LNOuWb9TVYs0Aqsc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 03d70453-0ec9-49c2-2c12-08def860240e X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 10:54:54.0237 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 1lcOqs0zdGB3RuUPwkXMC3E6zE1KfRA9QkxnJgmtCOx5scl/MWbgQYwK0wo4hPNe+p5UJsME3/i0JAsfsx6CqalT7RkQP+y1pwtDaNGkm6A= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3581 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 10:55:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243273 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8224 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=db856d41004301b3a56438efd957ef5cabb91530 [Adapted for binutils 2.42: only the shstrtabsize overflow check in bfd_elf_get_str_section applies. The second upstream hunk (DT_STRTAB) does not apply as 2.42 already unconditionally null-terminates the dynamic string table.] Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=db856d41004301b3a56438efd957ef5cabb91530] Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2025-8224.patch | 54 +++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index 063c6cc2a4..5534ce577f 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -79,5 +79,6 @@ SRC_URI = "\ file://CVE-2026-6846.patch \ file://CVE-2025-69645.patch \ file://CVE-2025-1147.patch \ + file://CVE-2025-8224.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch new file mode 100644 index 0000000000..914b9084c2 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-8224.patch @@ -0,0 +1,54 @@ +From db856d41004301b3a56438efd957ef5cabb91530 Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Sun, 25 Aug 2024 15:20:21 +0930 +Subject: [PATCH] PR32109, aborting at bfd/bfd.c:1236 in int _bfd_doprnt + +Since bfd_section for .strtab isn't set, print the section index +instead. Also, don't return NULL on this error as that results in +multiple mmap/read of the string table. (We could return NULL if we +arranged to set sh_size zero first, but just what we do with fuzzed +object files is of no concern, and terminating the table might make a +faulty object file usable.) + + PR 32109 + * elf.c (bfd_elf_get_str_section): Remove outdated comment, and + tweak shstrtabsize test to suit. Don't use string tab bfd_section + in error message, use index instead. Don't return NULL on + unterminated string section, terminate it. + (_bfd_elf_get_dynamic_symbols): Similarly terminate string table + section. + +[Backport note: Adapted for binutils 2.42. The upstream commit targets +a newer codebase that uses _bfd_mmap_readonly_persistent and has an +explicit unterminated-string error path with return NULL. In 2.42 the +code uses _bfd_alloc_and_read with shstrtabsize+1 allocation and +unconditionally null-terminates via shstrtab[shstrtabsize] = '\0'. +Only the shstrtabsize overflow check fix applies here (shstrtabsize + 1 <= 1 +changed to shstrtabsize == 0). The second upstream hunk (DT_STRTAB +error_return -> terminate) does not apply as 2.42 already +unconditionally null-terminates the dynamic string table.] + +CVE: CVE-2025-8224 +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=db856d41004301b3a56438efd957ef5cabb91530] + +Signed-off-by: Jaipaul Cheernam +--- + bfd/elf.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/bfd/elf.c b/bfd/elf.c +--- a/bfd/elf.c ++++ b/bfd/elf.c +@@ -285,9 +285,7 @@ bfd_elf_get_str_section (bfd *abfd, unsigned int shindex) + offset = i_shdrp[shindex]->sh_offset; + shstrtabsize = i_shdrp[shindex]->sh_size; + +- /* Allocate and clear an extra byte at the end, to prevent crashes +- in case the string table is not terminated. */ +- if (shstrtabsize + 1 <= 1 ++ if (shstrtabsize == 0 + || bfd_seek (abfd, offset, SEEK_SET) != 0 + || (shstrtab = _bfd_alloc_and_read (abfd, shstrtabsize + 1, + shstrtabsize)) == NULL) +-- +2.43.7 From patchwork Wed Aug 12 10:54:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95019 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35313C5CFDB for ; Wed, 12 Aug 2026 10:55:14 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5125.1786532103872253773 for ; Wed, 12 Aug 2026 03:55:04 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=IOSD1ZFI; spf=pass (domain: est.tech, ip: 52.101.72.49, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=NxATG+dkxt73rXoIIy4C8tBtY8yPzRGENzi0LqahSOEB0ouayju/ZT3AeUVzlWw+Klvf4ySqN0SvfZ0qromNFPaTMK34fWeW/4P7BI5A+WD4MD+yf/941w9IxvndUqDkv3BWw1vZ3rBwNS2aNhbUgtPc4qB6wJ4zjP8HsRJ3YYU6HhrsbUsnBvHoprr2wEPFkdnwW7ltEXsbXTh1O9M3dOengYg2/ALRaKZ7/yd9QHzRL47fAmlAiDPPB5xx4xoFKX+6qgRy1lrsVI8dXyoyRn9IWJh2YsV6E5ReY+iLdBvRffSZLyoQKTNy7QNQSeyd9+q7YhfB5PwDXREQH5pDSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5cZdPCEEWDGa8tzABx3+Ro41QEKj4PCF802cMOuxNvA=; b=fN4+UXVKzDfag2RTR9frJzn4SsRry78r3IJiqqfw2DQXJhOlYHTFjuj9aDA91etcjECXdr/DNkGPhE5Y3HXrQ4mlXARvMY6XoRoK7IP0A+3egurTIfZH8P4nX1eC/OwCQBNxYybaKlos6gC1AmKNB1ErtOVLxEYJHC8nhfshj3wTR2TKL1LBGRd1CBn3JeWXdJ9x1i9426s1gqGyh6SWyVr3+hemzgj0X4cbQpJkEHAn9eWdCxNOnsCyDqoI/Eu1GknFnS4/F2jPaVXgiM85ocpkwCqOyl2117YQaSJSVbPjwbLdUxNhE/iWSets0pB8RFZhB2GjjHW41VI0+C5ghg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5cZdPCEEWDGa8tzABx3+Ro41QEKj4PCF802cMOuxNvA=; b=IOSD1ZFIpUs7p9TIwoBVHCVKWovzPcSunkKoJnC7m4wfUv0SjvwvEX3+JY8kd2nRrHMoI3BZih16g20nfH+hQVqxIudhJ13roNWAylx21PeZznXJyZ9hOazuEBcHnFm8gv6PguuLW65iO1SaGrij7tPIZjbDsw4rTI+FRqJsBUaq9f2cEB7QsEC024TGsp/Llm64o3ihWyvSwRU6w2SoJnZKA5WS24pqLSFkb+tbQc6+K55YlI3n6trqWOfvINcKgkU60vY5QFClusOXc+vvBVYFivvUm8Q4HlquiT+Ifg0uoKaUEeKgC4mjSHDS7SO7ztC0QJEibgVkFgwIfhhUBQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by GV4P189MB3581.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b4::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.11; Wed, 12 Aug 2026 10:54:55 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 10:54:55 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH v2 3/4] binutils: fix CVE-2026-15003 Date: Wed, 12 Aug 2026 12:54:44 +0200 Message-ID: <20260812105445.24234-4-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812105445.24234-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> <20260812105445.24234-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: LO2P265CA0496.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:13a::21) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|GV4P189MB3581:EE_ X-MS-Office365-Filtering-Correlation-Id: 0a2934b5-ce91-4cdf-446b-08def8602519 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|10067099003|56012099006|11063799006|6133799003|4143699003|3023799007|18002099003|22082099003|13003099007; X-Microsoft-Antispam-Message-Info: oi+Dju1T2SdWUMdo1rMQSipmyhTJmvRlnXTOTVna61YkYGDjvTB4jfUMHrriyNiWfbHAYry7S6jySD7OuiCzUxG1LbBE1pws+fGmGak5I45l2MTmxhEv8wPFHpr9NMuqre7UXpsV/le52a3aIABNID/arAng6/u3KwPcZacXBI6pmKBIwqWZaFnsLnNVc34XkfRSnTH62k0TD3IWUaOIugOlVTOvGzC1kuX4JfbAQRlp/IWAhjHa4JyqgDyBE2p9mS/gahr+VzX0l5gvgOAKMwgegx+UDcoo5zefusoiDHhcNj0Nvsh/fb44891bf9B+EhjBadwgAcl5ct2UZ2KohP0hBZT9ReIZHoJhE7Vb2i6WMXqnO9HfxONcT2P3Hwb+LOBl8/yeUd8SrK/JreUwxrrRaLZbJRiMjFpDr+zzpvYt2QcG46t54v97GPb6nvvoe4qSu5faFGlikrnHh+1zTJTfQf2TCkX7LBvMtBkgwBp0oSbvOh3V0b8Uvgt/dIuVlb/QO7agrKvfQlt1cHz/enhu5YBbIaKDVxeIEFY+8KIi7xSzNT9ucliLfyWZjwgrfLH2AyhET3R6JfOFogp/8ynluhDJ7bUEK+JeeMgkDk1OHooAuFATtC3Sbz/B9O3V X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(10067099003)(56012099006)(11063799006)(6133799003)(4143699003)(3023799007)(18002099003)(22082099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Bw6NOCRrCvRzuMd/CfLUVNzj0f3edHfa0U8826o+Nj8sIC//F9/Q1YC4Yi3NOq4dHpdQKuWsVC4qALu85Menn71T5w0ze7nLx1shhmUzI92+6pvnAZopvguAOHjucT2AZf9RPnXPS6N3z8PJVg8sNC0Z0AqMWKYofmmHt5SwPOvCYkzDcHMwia/yzqOn1WLP5M4hac/erO950gzQXNTbN8poef3zqBHt1eOsxhaS/K8dCHQTJGiRI0tdwqaXPHTbVJ4s70krSKY9wcM4F9Vj9s9yUy7M94+1Admgf0JUdxvczjeGH81pwpQbT9s7uC0WMRJox8D5+LLOxINqHoBJOsEK+cDkFhji+VVveFgu2foZbZTrVAbzF6wVz7c9WrDKSThPBGUwkPrrbcX4kPGHVVJAhyBU3ASsZrsxihv7O1Hmpj9hrwoBV9SZtvrYWGruvlLL2mc2l4axcDEwbV2ph2W4ZThfV0IgfzwuaIa1P8eX3Eh5HjC+X5eB/auHrABi2boiE0qcHCkWdM6EzSOtLKwrjO93WS528drbON2Mc7S1L8uGFVjh4tyMN8ZsdJcG8zoeavH+FkuNrBmjLfX8tWYW8KyxECydRiaguAYM787F9xNSWgmU1/j+oFZqB8mIibAbOklHU9wYDfiH2tY4CEeA7Yp7gQTJpajjkEQPXv1YiKv7Li3eGhSDFaavqK1Bf+1UtGdCKdCw7nB9P2gfvvNW32M5uLyLXbTsQ3zR2N2gYPudygjhobR+LIT5F6MBLq3srx2Lgkm5kOqFgw4m//AZL5WA5m8atiICZMAXpAX77mPnC9+9R/jplHEsT59CBTP4fEcZSYZycJWcmJheDmydOPsFeU6iXcvtU1T+6zX6pKhv+RaUphMNElDuq4V+aqFOhImnI5Tv1Ccg8HKH8iF9e818lcdg6Io1zbG2TbCpWL0KPKAohy6eBE3jUiZbmb+11LEIxRzn8zDind6xrdPQlyOeG2q8TsgAi1UP1UO7Q03hFuWOUXrbgfob+yzTQapfklfYkF1kINn6QtMLWX6R+5OzPdQ5LpvB8GlMhY6XrNv2VklXBemnMXk3Uy7H3ld8sdjI/mk77AbgxesUQydg3a8LabuVqSLZhK4PIiQcIPoRZA9Dk/CikN5xMRvOd/wlZ8RlWUpYGhvepj+xFkvyYzhtgGmxsK6iIvm01yiXl0SHBDyVnTXCBUhT35GSGkdESvpeD3kROR29pKqBuaBSa+1We4462X/fNX12hgXI3gZsqre19rGkHM60yS3tA6yBRAQ9TsC3r5GA4sM8QvTus+1e9oRgGHIKWc8d0VoVFope+DxBsGFwVH3u+q07U1AZCXwyUIonUFnoM0Q0XE2Q3W1+6+fERR3rn8jchoFN3BlgRIWq/TnA2cNsokpqdcw3Kc0JVDdihnynMtuhGy9o877vl1IqI8wVUgj5SlJ4Yb/aLALX1KHhVjmzRPvufIaf9DxYeR/2C1j+16/yVjaRJTy6NBu1yCPct+LckOOyKmPulfVYOQFlw/umkCWZJXcwtyQXYgf0pQnJ/F2utFA0MSHO6c9gqtAgqDo3WRn6YRlyMQSJlqsFkEsXVpTqcd9Jp2Z9ZBfoflsVcrd0IbZsjZB7VteZMI69HPiQSd3yl/laoOX9CtJR3J6v0kXhJ6bX24EMffcs+zL20Yd3kt2u5nA8Ws25wcD3ld6ukmFZDQ4516j7aI7h+vlFJ9LwU+eVoGQSUkVlDWWGeF61sjFg/Ce5TVmY8T5BABnqDsw= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 0a2934b5-ce91-4cdf-446b-08def8602519 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 10:54:55.7218 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: xSZAk2g5oxkqjJ4c8F+TwhEodJi9JbPVLXv4vFE0vA6mtQGkxe5zhy/oF+evLDKdA7R9e1LmnlTP4eEGliOEpjXehHi7F221VoYoxRzr0Aw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3581 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 10:55:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243274 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-15003 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=23acf2f003f81b2f8d9d1997ea45d822d33d386c Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=23acf2f003f81b2f8d9d1997ea45d822d33d386c] Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2026-15003.patch | 400 ++++++++++++++++++ 2 files changed, 401 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index 5534ce577f..447529ffa9 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -80,5 +80,6 @@ SRC_URI = "\ file://CVE-2025-69645.patch \ file://CVE-2025-1147.patch \ file://CVE-2025-8224.patch \ + file://CVE-2026-15003.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch b/meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch new file mode 100644 index 0000000000..2f5c42e1b9 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2026-15003.patch @@ -0,0 +1,400 @@ +From 23acf2f003f81b2f8d9d1997ea45d822d33d386c Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Thu, 9 Apr 2026 09:06:27 +0930 +Subject: [PATCH] PR 34053 buffer overflow in xcoff_link_add_symbols + +This patch adds two sanity checks with error reporting in +xcoff_link_add_symbols before reading symbol aux entries, add extends +assertions in later functions. A whole lot of unnecessary casts are +also tidied. + + PR 34053 + * xcofflink.c: Remove unnecessary casts throughout. + (xcoff_link_add_symbols): Sanity check aux entries are within + symbol buffer. + (bfd_xcoff_build_dynamic_sections): Assert the above is true. + (xcoff_link_input_bfd): Likewise. + +CVE: CVE-2026-15003 +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=23acf2f003f81b2f8d9d1997ea45d822d33d386c] + +Signed-off-by: Jaipaul Cheernam +--- + bfd/xcofflink.c | 132 +++++++++++++++++++++++------------------------- + 1 file changed, 62 insertions(+), 70 deletions(-) + +diff --git a/bfd/xcofflink.c b/bfd/xcofflink.c +index 7f1c0df760f..cf3b33e7202 100644 +--- a/bfd/xcofflink.c ++++ b/bfd/xcofflink.c +@@ -371,7 +371,7 @@ _bfd_xcoff_canonicalize_dynamic_symtab (bfd *abfd, asymbol **psyms) + { + char *c; + +- c = bfd_alloc (abfd, (bfd_size_type) SYMNMLEN + 1); ++ c = bfd_alloc (abfd, SYMNMLEN + 1); + if (c == NULL) + return -1; + memcpy (c, ldsym._l._l_name, SYMNMLEN); +@@ -1038,7 +1038,7 @@ xcoff_link_add_dynamic_symbols (bfd *abfd, struct bfd_link_info *info) + { + char *dsnm; + +- dsnm = bfd_malloc ((bfd_size_type) strlen (name) + 2); ++ dsnm = bfd_malloc (strlen (name) + 2); + if (dsnm == NULL) + return false; + dsnm[0] = '.'; +@@ -1081,7 +1081,7 @@ xcoff_link_add_dynamic_symbols (bfd *abfd, struct bfd_link_info *info) + coff_section_data (abfd, lsec)->contents = NULL; + + /* Record this file in the import files. */ +- n = bfd_alloc (abfd, (bfd_size_type) sizeof (struct xcoff_import_file)); ++ n = bfd_alloc (abfd, sizeof (*n)); + if (n == NULL) + return false; + n->next = NULL; +@@ -1477,7 +1477,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + bfd_vma value; + struct xcoff_link_hash_entry *set_toc; + +- bfd_coff_swap_sym_in (abfd, (void *) esym, (void *) &sym); ++ bfd_coff_swap_sym_in (abfd, esym, &sym); + + /* In this pass we are only interested in symbols with csect + information. */ +@@ -1523,9 +1523,12 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + { + union internal_auxent auxlin; + +- bfd_coff_swap_aux_in (abfd, (void *) (esym + symesz), ++ if (symesz >= (size_t) (esym_end - esym)) ++ goto badaux; ++ ++ bfd_coff_swap_aux_in (abfd, esym + symesz, + sym.n_type, sym.n_sclass, +- 0, sym.n_numaux, (void *) &auxlin); ++ 0, sym.n_numaux, &auxlin); + + if (auxlin.x_sym.x_fcnary.x_fcn.x_lnnoptr != 0) + { +@@ -1552,7 +1555,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + + linpstart = (reloc_info[enclosing->target_index].linenos + + linoff); +- bfd_coff_swap_lineno_in (abfd, (void *) linpstart, (void *) &lin); ++ bfd_coff_swap_lineno_in (abfd, linpstart, &lin); + if (lin.l_lnno == 0 + && ((bfd_size_type) lin.l_addr.l_symndx + == ((esym +@@ -1567,8 +1570,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + linp < linpend; + linp += linesz) + { +- bfd_coff_swap_lineno_in (abfd, (void *) linp, +- (void *) &lin); ++ bfd_coff_swap_lineno_in (abfd, linp, &lin); + if (lin.l_lnno == 0) + break; + } +@@ -1589,21 +1591,21 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + visibility = sym.n_type & SYM_V_MASK; + + /* Pick up the csect auxiliary information. */ +- if (sym.n_numaux == 0) ++ if (sym.n_numaux < 1 ++ || sym.n_numaux * symesz >= (size_t) (esym_end - esym)) + { ++ badaux: + _bfd_error_handler + /* xgettext:c-format */ +- (_("%pB: class %d symbol `%s' has no aux entries"), ++ (_("%pB: class %d symbol '%s' has missing aux entries"), + abfd, sym.n_sclass, name); + bfd_set_error (bfd_error_bad_value); + goto error_return; + } + +- bfd_coff_swap_aux_in (abfd, +- (void *) (esym + symesz * sym.n_numaux), ++ bfd_coff_swap_aux_in (abfd, esym + symesz * sym.n_numaux, + sym.n_type, sym.n_sclass, +- sym.n_numaux - 1, sym.n_numaux, +- (void *) &aux); ++ sym.n_numaux - 1, sym.n_numaux, &aux); + + smtyp = SMTYP_SMTYP (aux.x_csect.x_smtyp); + +@@ -1726,7 +1728,7 @@ xcoff_link_add_symbols (bfd *abfd, struct bfd_link_info *info) + + erelsym = ((bfd_byte *) obj_coff_external_syms (abfd) + + rel->r_symndx * symesz); +- bfd_coff_swap_sym_in (abfd, (void *) erelsym, (void *) &relsym); ++ bfd_coff_swap_sym_in (abfd, erelsym, &relsym); + if (EXTERN_SYM_P (relsym.n_sclass)) + { + const char *relname; +@@ -2507,7 +2509,7 @@ xcoff_link_check_ar_symbols (bfd *abfd, + { + struct internal_syment sym; + +- bfd_coff_swap_sym_in (abfd, (void *) esym, (void *) &sym); ++ bfd_coff_swap_sym_in (abfd, esym, &sym); + esym += (sym.n_numaux + 1) * symesz; + + if (EXTERN_SYM_P (sym.n_sclass) && sym.n_scnum != N_UNDEF) +@@ -4005,7 +4007,7 @@ bfd_xcoff_size_dynamic_sections (bfd *output_bfd, + return true; + + xcoff_link_hash_traverse (xcoff_hash_table (info), xcoff_post_gc_symbol, +- (void *) ldinfo); ++ ldinfo); + if (ldinfo->failed) + goto error_return; + +@@ -4216,7 +4218,8 @@ bfd_xcoff_build_dynamic_sections (bfd *output_bfd, + /* Read in the csect information, if any. */ + if (CSECT_SYM_P (sym.n_sclass)) + { +- BFD_ASSERT (sym.n_numaux > 0); ++ BFD_ASSERT (sym.n_numaux > 0 ++ && symesz * sym.n_numaux < (size_t) (esymend - esym)); + bfd_coff_swap_aux_in (sub, esym + symesz * sym.n_numaux, + sym.n_type, sym.n_sclass, + sym.n_numaux - 1, sym.n_numaux, &aux); +@@ -4307,7 +4310,7 @@ bfd_xcoff_link_generate_rtinit (bfd *abfd, + { + struct bfd_in_memory *bim; + +- bim = bfd_malloc ((bfd_size_type) sizeof (* bim)); ++ bim = bfd_malloc (sizeof (*bim)); + if (bim == NULL) + return false; + +@@ -4316,7 +4319,7 @@ bfd_xcoff_link_generate_rtinit (bfd *abfd, + + abfd->link.next = 0; + abfd->format = bfd_object; +- abfd->iostream = (void *) bim; ++ abfd->iostream = bim; + abfd->flags = BFD_IN_MEMORY; + abfd->iovec = &_bfd_memory_iovec; + abfd->direction = write_direction; +@@ -4876,8 +4879,8 @@ bfd_xcoff_size_stubs (struct bfd_link_info *info) + } + + bfd_coff_swap_sym_in (input_bfd, +- (void *) esyms + irel->r_symndx * symesz, +- (void *) &sym); ++ esyms + irel->r_symndx * symesz, ++ &sym); + + sym_sec = xcoff_data (input_bfd)->csects[irel->r_symndx]; + sym_value = sym.n_value - sym_sec->vma; +@@ -5250,17 +5253,16 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + int smtyp = 0; + int add; + +- bfd_coff_swap_sym_in (input_bfd, (void *) esym, (void *) isymp); ++ bfd_coff_swap_sym_in (input_bfd, esym, isymp); + + /* Read in the csect information, if any. */ + if (CSECT_SYM_P (isymp->n_sclass)) + { +- BFD_ASSERT (isymp->n_numaux > 0); +- bfd_coff_swap_aux_in (input_bfd, +- (void *) (esym + isymesz * isymp->n_numaux), ++ BFD_ASSERT (isymp->n_numaux > 0 ++ && isymesz * isymp->n_numaux < (size_t) (esym_end - esym)); ++ bfd_coff_swap_aux_in (input_bfd, esym + isymesz * isymp->n_numaux, + isymp->n_type, isymp->n_sclass, +- isymp->n_numaux - 1, isymp->n_numaux, +- (void *) &aux); ++ isymp->n_numaux - 1, isymp->n_numaux, &aux); + + smtyp = SMTYP_SMTYP (aux.x_csect.x_smtyp); + } +@@ -5475,12 +5477,10 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + if ((bfd_size_type) flinfo->last_file_index >= syment_base) + { + /* The last C_FILE symbol is in this input file. */ +- bfd_coff_swap_sym_out (output_bfd, +- (void *) &flinfo->last_file, +- (void *) (flinfo->outsyms +- + ((flinfo->last_file_index +- - syment_base) +- * osymesz))); ++ bfd_coff_swap_sym_out ++ (output_bfd, &flinfo->last_file, ++ flinfo->outsyms + (flinfo->last_file_index ++ - syment_base) * osymesz); + } + else + { +@@ -5489,9 +5489,8 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + borrow *outsym temporarily. */ + file_ptr pos; + +- bfd_coff_swap_sym_out (output_bfd, +- (void *) &flinfo->last_file, +- (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &flinfo->last_file, ++ outsym); + + pos = obj_sym_filepos (output_bfd); + pos += flinfo->last_file_index * osymesz; +@@ -5557,7 +5556,7 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + } + + /* Output the symbol. */ +- bfd_coff_swap_sym_out (output_bfd, (void *) &isym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &isym, outsym); + + esym += isymesz; + outsym += osymesz; +@@ -5566,9 +5565,9 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + { + union internal_auxent aux; + +- bfd_coff_swap_aux_in (input_bfd, (void *) esym, isymp->n_type, +- isymp->n_sclass, i, isymp->n_numaux, +- (void *) &aux); ++ bfd_coff_swap_aux_in (input_bfd, esym, ++ isymp->n_type, isymp->n_sclass, i, ++ isymp->n_numaux, &aux); + + if (isymp->n_sclass == C_FILE) + { +@@ -5796,9 +5795,9 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + } + } + +- bfd_coff_swap_aux_out (output_bfd, (void *) &aux, isymp->n_type, ++ bfd_coff_swap_aux_out (output_bfd, &aux, isymp->n_type, + isymp->n_sclass, i, isymp->n_numaux, +- (void *) outsym); ++ outsym); + outsym += osymesz; + esym += isymesz; + } +@@ -5820,10 +5819,9 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + && (bfd_size_type) flinfo->last_file_index >= syment_base) + { + flinfo->last_file.n_value = output_index; +- bfd_coff_swap_sym_out (output_bfd, (void *) &flinfo->last_file, +- (void *) (flinfo->outsyms +- + ((flinfo->last_file_index - syment_base) +- * osymesz))); ++ bfd_coff_swap_sym_out (output_bfd, &flinfo->last_file, ++ flinfo->outsyms + (flinfo->last_file_index ++ - syment_base) * osymesz); + } + + /* Write the modified symbols to the output file. */ +@@ -6036,16 +6034,13 @@ xcoff_link_input_bfd (struct xcoff_final_link_info *flinfo, + void * auxptr; + union internal_auxent aux; + +- auxptr = ((void *) +- (((bfd_byte *) +- obj_coff_external_syms (input_bfd)) +- + ((r_symndx + is->n_numaux) +- * isymesz))); ++ auxptr = ((bfd_byte *) ++ obj_coff_external_syms (input_bfd) ++ + (r_symndx + is->n_numaux) * isymesz); + bfd_coff_swap_aux_in (input_bfd, auxptr, + is->n_type, is->n_sclass, + is->n_numaux - 1, +- is->n_numaux, +- (void *) &aux); ++ is->n_numaux, &aux); + if (SMTYP_SMTYP (aux.x_csect.x_smtyp) == XTY_SD + && aux.x_csect.x_smclas == XMC_TC0) + indx = flinfo->toc_symindx; +@@ -6564,12 +6559,12 @@ xcoff_write_global_symbol (struct bfd_hash_entry *bh, void * inf) + irsym.n_type = T_NULL; + irsym.n_numaux = 1; + +- bfd_coff_swap_sym_out (output_bfd, (void *) &irsym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &irsym, outsym); + outsym += bfd_coff_symesz (output_bfd); + + /* Note : iraux is initialized above. */ +- bfd_coff_swap_aux_out (output_bfd, (void *) &iraux, T_NULL, C_HIDEXT, +- 0, 1, (void *) outsym); ++ bfd_coff_swap_aux_out (output_bfd, &iraux, T_NULL, C_HIDEXT, ++ 0, 1, outsym); + outsym += bfd_coff_auxesz (output_bfd); + + if (h->indx >= 0) +@@ -6807,12 +6802,11 @@ xcoff_write_global_symbol (struct bfd_hash_entry *bh, void * inf) + isym.n_type = T_NULL; + isym.n_numaux = 1; + +- bfd_coff_swap_sym_out (output_bfd, (void *) &isym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &isym, outsym); + outsym += bfd_coff_symesz (output_bfd); + + aux.x_csect.x_smclas = h->smclas; +- bfd_coff_swap_aux_out (output_bfd, (void *) &aux, T_NULL, isym.n_sclass, 0, 1, +- (void *) outsym); ++ bfd_coff_swap_aux_out (output_bfd, &aux, T_NULL, isym.n_sclass, 0, 1, outsym); + outsym += bfd_coff_auxesz (output_bfd); + + if ((h->root.type == bfd_link_hash_defined +@@ -6827,13 +6821,12 @@ xcoff_write_global_symbol (struct bfd_hash_entry *bh, void * inf) + isym.n_sclass = C_WEAKEXT; + else + isym.n_sclass = C_EXT; +- bfd_coff_swap_sym_out (output_bfd, (void *) &isym, (void *) outsym); ++ bfd_coff_swap_sym_out (output_bfd, &isym, outsym); + outsym += bfd_coff_symesz (output_bfd); + + aux.x_csect.x_smtyp = XTY_LD; + aux.x_csect.x_scnlen.u64 = obj_raw_syment_count (output_bfd); +- bfd_coff_swap_aux_out (output_bfd, (void *) &aux, T_NULL, C_EXT, 0, 1, +- (void *) outsym); ++ bfd_coff_swap_aux_out (output_bfd, &aux, T_NULL, C_EXT, 0, 1, outsym); + outsym += bfd_coff_auxesz (output_bfd); + } + +@@ -6929,8 +6922,8 @@ xcoff_reloc_link_order (bfd *output_bfd, + howto->name, addend, NULL, NULL, (bfd_vma) 0); + break; + } +- ok = bfd_set_section_contents (output_bfd, output_section, (void *) buf, +- (file_ptr) link_order->offset, size); ++ ok = bfd_set_section_contents (output_bfd, output_section, buf, ++ link_order->offset, size); + free (buf); + if (! ok) + return false; +@@ -7395,8 +7388,7 @@ _bfd_xcoff_bfd_final_link (bfd *abfd, struct bfd_link_info *info) + if (flinfo.last_file_index != -1) + { + flinfo.last_file.n_value = -(bfd_vma) 1; +- bfd_coff_swap_sym_out (abfd, (void *) &flinfo.last_file, +- (void *) flinfo.outsyms); ++ bfd_coff_swap_sym_out (abfd, &flinfo.last_file, flinfo.outsyms); + pos = obj_sym_filepos (abfd) + flinfo.last_file_index * symesz; + if (bfd_seek (abfd, pos, SEEK_SET) != 0 + || bfd_write (flinfo.outsyms, symesz, abfd) != symesz) +@@ -7480,7 +7472,7 @@ _bfd_xcoff_bfd_final_link (bfd *abfd, struct bfd_link_info *info) + appear in the symbol table, which is not necessarily by + address. So we sort them here. There may be a better way to + do this. */ +- qsort ((void *) flinfo.section_info[o->target_index].relocs, ++ qsort (flinfo.section_info[o->target_index].relocs, + o->reloc_count, sizeof (struct internal_reloc), + xcoff_sort_relocs); + +@@ -7488,7 +7480,7 @@ _bfd_xcoff_bfd_final_link (bfd *abfd, struct bfd_link_info *info) + irelend = irel + o->reloc_count; + erel = external_relocs; + for (; irel < irelend; irel++, rel_hash++, erel += relsz) +- bfd_coff_swap_reloc_out (abfd, (void *) irel, (void *) erel); ++ bfd_coff_swap_reloc_out (abfd, irel, erel); + + rel_size = relsz * o->reloc_count; + if (bfd_seek (abfd, o->rel_filepos, SEEK_SET) != 0 From patchwork Wed Aug 12 10:54:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 95018 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 438A8C5AD5A for ; Wed, 12 Aug 2026 10:55:14 +0000 (UTC) Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.5125.1786532103872253773 for ; Wed, 12 Aug 2026 03:55:05 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=zwRC4jxQ; spf=pass (domain: est.tech, ip: 52.101.72.49, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=LrsDj7SKoA3ny4c1AWqxLPJCcvQfjMCvR9AIVSoU6LDwZduNcr/r2rtRJf06R7xNbbV/auoAfiYKTreFR1yDrRm2ov0r8ZW0RD04rBg5tMcj10+VEIR8P3yOdbBv/Uv8o/jxYWPHwvZpaNpDC0m720BXC7RwnGqcyt95sX47y5rKLfXYIDg2ztBnSieMfDIsePfYpZK6AWVpeRsIjOhIwIdHo3XkCHuo4mP+GG6SXslPhcZ+5+B55rPSjtADJGXZ4IfhBIU/iqQVXPbA6lVYAQbNKGNUmnQcqLk5P8sCY7iSldlfXhZmSSt8UN2ykGO9L0dcZKiGxvRbELMDn+KhaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6JGdcsbxBOQsgtUJrTVny4PGBf7Nds75KsYALml/jxo=; b=hO/g0+xZjGLhcDj/G6LW59t7xLx1asmNprj5NFaE+/Obb0Ec9JQtw4hd/vSqFCAGP4JQraZgkKqLyt0wG87aM4N+ivCnIsKbF36umPOX93f3jR6FGQhO6Twrxv5l6kMd65U31SbNY8stjE/uSI/WR4xlkVvrDFLJCKHNa5ibvYaVN/vBFQ0FkAgVI5LyJ9kVtee/+neEdPm6Q6EG6NJ4ykca52DkJOyF3mIt0nLRNo1XjsYtvW0xR9R/+TgA71DCbW+Luy2cBg14joRcyqhOdrrqAMzSfcZKrapeAmJqB+IppS2RM8Sq5qL1zT1B3wv7U1x3BPZZHBEEZLVG09T6iQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6JGdcsbxBOQsgtUJrTVny4PGBf7Nds75KsYALml/jxo=; b=zwRC4jxQPy8aQ71YjraQvleF/yvtB9AzNzre/Tm54kKDV31gKoDfLVdUs8kXnk00o+5Mb7XJ9vojYktptUS4CRJCenuizHTLfeB5KfxRLMqylSvnxarsDBEYZk1BffWXveZy+nHRe5/3+0zuIgYi/KEJs9L5ECPt3wyR4xWspNKQPD64d1fQKGZfYW27Cj5cpShLi/Tst7X3MAu17l3Dwh+uXS63YlkPwYbL0YX/6eEWYT+1EIBxAkO0C/ao2HtuaqHQsKFcDylUdryxGKS3zcgQeIG8Qp9A176hv5hXMsazXkO4XB/7ZTDUG71Lkg75nnIhsdYT8wv74c1pkYBxYQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by GV4P189MB3581.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:2b4::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.11; Wed, 12 Aug 2026 10:54:57 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0315.012; Wed, 12 Aug 2026 10:54:57 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [scarthgap][PATCH v2 4/4] binutils: fix CVE-2026-18220 Date: Wed, 12 Aug 2026 12:54:45 +0200 Message-ID: <20260812105445.24234-5-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260812105445.24234-1-jaipaul.cheernam@est.tech> References: <20260812072822.22227-1-jaipaul.cheernam@est.tech> <20260812105445.24234-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: LO4P123CA0162.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:188::23) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|GV4P189MB3581:EE_ X-MS-Office365-Filtering-Correlation-Id: dacf39e8-b4d9-403c-7079-08def860261e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|366016|23010399003|10067099003|56012099006|11063799006|6133799003|4143699003|3023799007|18002099003|22082099003|13003099007; X-Microsoft-Antispam-Message-Info: x0xyKaH2/lx2XlzX6L8iIOysltAtijm5l01VgLcQAqFwBwJGC8OEl7jv981ZgcJMCib8nvm3oNYRTPZnxVVg9fcmHgkco/4TKi9a5wcOnxdHhczm3yv9HQIdif68wJgCaSeyZ+vsipcfkDjqeVxlGx2axxKL+OCfSOqHSs35qlRdhAyFv9MnxJHBofMK/bxuyaNncjJfdicSH5sgOpFBc6wHOzy+2cycTB6NX0qtDrQkwsN0HJI7mpA+uPKSRtAMZ5ei7WeFEDi9WgQ/HGA2X++0bo/6bTSLSCicJq6ay0vLt02+5fHfSr+zuzoDDe1t5N8JXrXd3t62ipAGjl4EEqIJuDXOs/DgqiGuo+Kw7fkKLuq/RCfDXu2WxuyBuPBqOk2tOCFaIZC06RjociLxiXWrHNmAChM5fmCbab66dKLjFTLJF8+I5uefxSOH2PPIC3D58pdhhVpTkrh5X5Z09+nu9moWdTbNUaAKw7v7pDYehpE41ndsuc7nzmXjfQwFpQVhfS5EJ71mbJdRRGn0bo8L9B62HaVqHI0xN6+vW0xfs0jIE+orNiDz+6RMVvGaT2zLjpKuKETISzwF2AW+J6mNc71WuOJlLBtNEyIhVvSLcaFJFHCVlEp+EIK8pGFN X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(23010399003)(10067099003)(56012099006)(11063799006)(6133799003)(4143699003)(3023799007)(18002099003)(22082099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: A78DzU/ik+nB4bLrTPSQAIgl3sq2lQr6iq88UqnJQtFQHvytp1boNllIGaKnF+/rmUf57I8K+N2VgEUARZgYUU09mfHfrU+BEWdNg0zpzeefx6c0tq2Byp4pTU4ChdXfwTqnkIwxvZcPkzt8ywR58ARm7tWUzHLsbA7KIEa5+S6LFApeh+pESb6j6JprEBHU6GXU9c6/CK5tnD1TY3h83RF306gAxHAkMVNT/WailtM7/gSMENM40iJImakHr7r+T7v+fMvLNQAZBNwyi97pMV8rEhONJpHTYY5YquhVemf6tf5dxzfOmNpIqxL+0VJt/0zRQKeC1xvYhoIHluWgnLNBCC8BZ4bZNO/ickRqGz6g8OEYmsd5pHLVTjwQak2uQYMcdCTJmLmDykwYzv7MFqklxvie2iGzgjt9ZjsvrVtImdNKgu+OI1WmhdKOGeT6xDw29+WQMXPcWFQadv3Z1+NhXhcl04i2PXBkDJ4S8pbumbKKVg70VHqdvLfvAYNEbOeh5vFhrNz9II8ZVbRXVUpY43seABaHOvJj02cfaBa5ylIGiNhA7bRPk8Er5aW3nbyEJyjdicZxiXDwpySRbmhyvn0MaafUh2/lBUIstymFPL9PVBk7ozGTC0H0k5zE95L2prjfbfYytauN8C7PVR9+OInGGz+kFS6MoIcBrkSjLD/lC16m42pCtrBHP2yeJB46PzqgsQuVepaLqj8RxuMWmYTTfwzzTjhaJ+zHJxvftL8iKmmN8zazRDcZ92wyvDTXNj9N6s8hxtQfFBvrqULbglq7iVbGAM+uGZud7ilo3JLrSE1OtMCIKR25jPmIN+J9YJEcXiidlJCR02Mr4oXomAd1zfqqAJzGazHkSeq7krauIAYStbWRsDuKEP+YTQZ3H1D+R2Q5lpcNQdIo/EwmlduJUSqWepwdZCHyWHbY7ufZISJfjSc1lvArAE3hP3fBC2gxZaI26WZPuxjf96hYZOa5GJ81aJhgBjRlqDzfpr9vhwjxfsqhVofs+lN87O5w1Zj6BwXmiUo8CI3FpQMJ0s2JIINUk0wqTZovOxQ31PjZDfSng2RsO7kf2Aupfvnr6FaFfEBy2+7/5S080OTme2m4lZMtCP+jR9dVakgc9kDs6UwYod1vVYVzjDg9bfWIVpQG6XuVXyBPPYh6x/1igXGme5HPAWko6P+UKTKsN7imGX2KYQPTTzyNb+8nat0bq8Kr+GXyGo5TFNQ5GfdIAYvfSQm+oiZgi8A99JDGiKIH6wrYdEr/5rpk+gInUrUgU1zNrrqrvrVYsenKL9TEYD6FjyGcTfcv9XyVWQX6g+UKY/sQ4sJ/TfJbvVsnshaO3RYq4d4qW3a2xky+RHXsoq3WipC/TlAMelRBMFs45+7xZQX3kj/Z5gJQE7DR3wH43ok2/U/1o8o47MEuPgZVBu+EVSj27CORpxiBUvCo+Am/1OyjqRhfnQy6Ct+ymXMHYEq3/Anpz7NI/O//yatH+uhAFfcCMfJxz7vAoITLG/RIIelwD8oJO2H5NmINRf/CLkMNyjeYAm+PZodetTDVTl9jklnfqAPoAijT/YkButbVTfoXVd6+d4Y8vz92P9UYw2xbzhEMXf8FYqwYdUwCAZx46kRLONmmWKyQ/mSuwkuwIUSbORM8EcOai+MtZE/TRvtw0h9C8erBI05+yWlOsYpanTClYbLqKLkfWR/WIL4LMtEZ5fySvBaYE89OUnGq4qT862f46MpFkWIlDIqPfNM9oNZeSX9laWuOnvc= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: dacf39e8-b4d9-403c-7079-08def860261e X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 10:54:57.4305 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: FtY8K0g0e8Tfogc0ZdvtnPArzlPHOtOxL/hyxHE5/M8CBqeRdAnNhnBhiF9QQNZkkxLW2Tx7iwILe4GwS9ABfovqGGCx5BQKKSEm5IuzIAI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4P189MB3581 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 10:55:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243275 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-18220 https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=114e3aae2b7e34057c8909301eaf78c15687e8e5 Test results: binutils-cross-testsuite 2.42 (x86_64-oe-linux): Before: binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported After: binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported gas: 1871 passed, 4 unexpected failures, 2 unsupported ld: 1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=114e3aae2b7e34057c8909301eaf78c15687e8e5] Signed-off-by: Jaipaul Cheernam --- .../binutils/binutils-2.42.inc | 1 + .../binutils/binutils/CVE-2026-18220.patch | 65 +++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index 447529ffa9..d395ae1b1e 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc @@ -81,5 +81,6 @@ SRC_URI = "\ file://CVE-2025-1147.patch \ file://CVE-2025-8224.patch \ file://CVE-2026-15003.patch \ + file://CVE-2026-18220.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch b/meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch new file mode 100644 index 0000000000..e915fb223a --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch @@ -0,0 +1,65 @@ +From 114e3aae2b7e34057c8909301eaf78c15687e8e5 Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Sun, 28 Jun 2026 09:11:46 +0930 +Subject: [PATCH] asan: buffer overflow in elf32_dlx_relocate26 + + * elf32-dlx.c (elf32_dlx_relocate26): Sanity check reloc offset. + (elf32_dlx_relocate16): Likewise. + (_bfd_dlx_elf_hi16_reloc): Likewise, and remove ineffective + existing check. + +CVE: CVE-2026-18220 +Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=114e3aae2b7e34057c8909301eaf78c15687e8e5] + +Signed-off-by: Jaipaul Cheernam +--- + bfd/elf32-dlx.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/bfd/elf32-dlx.c b/bfd/elf32-dlx.c +index 2dfeb4d7390..0f9a49695d7 100644 +--- a/bfd/elf32-dlx.c ++++ b/bfd/elf32-dlx.c +@@ -77,6 +77,10 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd, + return bfd_reloc_ok; + } + ++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, ++ input_section, reloc_entry->address)) ++ return bfd_reloc_outofrange; ++ + ret = bfd_reloc_ok; + + if (bfd_is_und_section (symbol->section) +@@ -89,9 +93,6 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd, + relocation += reloc_entry->addend; + relocation += bfd_get_16 (abfd, (bfd_byte *)data + reloc_entry->address); + +- if (reloc_entry->address > bfd_get_section_limit (abfd, input_section)) +- return bfd_reloc_outofrange; +- + bfd_put_16 (abfd, (short)((relocation >> 16) & 0xFFFF), + (bfd_byte *)data + reloc_entry->address); + +@@ -143,6 +144,10 @@ elf32_dlx_relocate16 (bfd *abfd, + return bfd_reloc_undefined; + } + ++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, ++ input_section, reloc_entry->address)) ++ return bfd_reloc_outofrange; ++ + insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address); + allignment = 1 << (input_section->output_section->alignment_power - 1); + vallo = insn & 0x0000FFFF; +@@ -206,6 +211,10 @@ elf32_dlx_relocate26 (bfd *abfd, + return bfd_reloc_undefined; + } + ++ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd, ++ input_section, reloc_entry->address)) ++ return bfd_reloc_outofrange; ++ + insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address); + allignment = 1 << (input_section->output_section->alignment_power - 1); + vallo = insn & 0x03FFFFFF;