Skip to content

Commit 0cf609c

Browse files
azurelinux-securityjykanasearchana25-ms
authored
[AutoPR- Security] Patch binutils for CVE-2025-11083, CVE-2025-11082 [MEDIUM] (microsoft#14765)
Co-authored-by: jykanase <[email protected]> Co-authored-by: Archana Shettigar <[email protected]>
1 parent 2d39776 commit 0cf609c

File tree

8 files changed

+147
-15
lines changed

8 files changed

+147
-15
lines changed
Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 1a2eb7a4a288ffe6d1a7a6a7260c1a59d8638f46 Mon Sep 17 00:00:00 2001
2+
From: "H.J. Lu" <[email protected]>
3+
Date: Mon, 22 Sep 2025 15:20:34 +0800
4+
Subject: [PATCH] elf: Don't read beyond .eh_frame section size
5+
6+
PR ld/33464
7+
* elf-eh-frame.c (_bfd_elf_parse_eh_frame): Don't read beyond
8+
.eh_frame section size.
9+
10+
Signed-off-by: H.J. Lu <[email protected]>
11+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
12+
Upstream-reference: https://github.com/bminor/binutils-gdb/commit/ea1a0737c7692737a644af0486b71e4a392cbca8.patch
13+
---
14+
bfd/elf-eh-frame.c | 8 ++++++--
15+
1 file changed, 6 insertions(+), 2 deletions(-)
16+
17+
diff --git a/binutils-2.37/bfd/elf-eh-frame.c b/binutils-2.37/bfd/elf-eh-frame.c
18+
index 6ce6d225..f1f6b463 100644
19+
--- a/bfd/elf-eh-frame.c
20+
+++ b/bfd/elf-eh-frame.c
21+
@@ -733,6 +733,7 @@ _bfd_elf_parse_eh_frame (bfd *abfd, struct bfd_link_info *info,
22+
if (hdr_id == 0)
23+
{
24+
unsigned int initial_insn_length;
25+
+ char *null_byte;
26+
27+
/* CIE */
28+
this_inf->cie = 1;
29+
@@ -749,10 +750,13 @@ _bfd_elf_parse_eh_frame (bfd *abfd, struct bfd_link_info *info,
30+
REQUIRE (cie->version == 1
31+
|| cie->version == 3
32+
|| cie->version == 4);
33+
- REQUIRE (strlen ((char *) buf) < sizeof (cie->augmentation));
34+
+ null_byte = memchr ((char *) buf, 0, end - buf);
35+
+ REQUIRE (null_byte != NULL);
36+
+ REQUIRE ((size_t) (null_byte - (char *) buf)
37+
+ < sizeof (cie->augmentation));
38+
39+
strcpy (cie->augmentation, (char *) buf);
40+
- buf = (bfd_byte *) strchr ((char *) buf, '\0') + 1;
41+
+ buf = (bfd_byte *) null_byte + 1;
42+
this_inf->u.cie.aug_str_len = buf - start - 1;
43+
ENSURE_NO_RELOCS (buf);
44+
if (buf[0] == 'e' && buf[1] == 'h')
45+
--
46+
2.45.4
47+
Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
From b3847cb425387f93f099513980721e3d87c236de Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Wed, 1 Oct 2025 19:12:40 +0000
4+
Subject: [PATCH] bfd/elf: Avoid matching corrupt section header in linker
5+
input (PR ld/33457)
6+
7+
- Change elf_swap_shdr_in to return bool; return false for corrupt section header when abfd->is_linker_input.
8+
- In elf_object_p, check return value of elf_swap_shdr_in and reject on failure.
9+
- Preserve warning message and set abfd->read_only after rejection logic.
10+
11+
Backport of upstream patch 9ca499644a21ceb3f946d1c179c38a83be084490.
12+
13+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
14+
Upstream-reference: AI Backport of https://github.com/bminor/binutils-gdb/commit/9ca499644a21ceb3f946d1c179c38a83be084490.patch
15+
---
16+
bfd/elfcode.h | 16 ++++++++++------
17+
1 file changed, 10 insertions(+), 6 deletions(-)
18+
19+
diff --git a/bfd/elfcode.h b/bfd/elfcode.h
20+
index 7eb27c2e..8195b92e 100644
21+
--- a/bfd/elfcode.h
22+
+++ b/bfd/elfcode.h
23+
@@ -298,7 +298,7 @@ elf_swap_ehdr_out (bfd *abfd,
24+
/* Translate an ELF section header table entry in external format into an
25+
ELF section header table entry in internal format. */
26+
27+
-static void
28+
+static bool
29+
elf_swap_shdr_in (bfd *abfd,
30+
const Elf_External_Shdr *src,
31+
Elf_Internal_Shdr *dst)
32+
@@ -325,9 +325,12 @@ elf_swap_shdr_in (bfd *abfd,
33+
&& ((ufile_ptr) dst->sh_offset > filesize
34+
|| dst->sh_size > filesize - dst->sh_offset))
35+
{
36+
- abfd->read_only = 1;
37+
_bfd_error_handler (_("warning: %pB has a section "
38+
"extending past end of file"), abfd);
39+
+ /* PR ld/33457: Don't match corrupt section header. */
40+
+ if (abfd->is_linker_input)
41+
+ return false;
42+
+ abfd->read_only = 1;
43+
}
44+
}
45+
dst->sh_link = H_GET_32 (abfd, src->sh_link);
46+
@@ -336,6 +339,7 @@ elf_swap_shdr_in (bfd *abfd,
47+
dst->sh_entsize = H_GET_WORD (abfd, src->sh_entsize);
48+
dst->bfd_section = NULL;
49+
dst->contents = NULL;
50+
+ return true;
51+
}
52+
53+
/* Translate an ELF section header table entry in internal format into an
54+
@@ -628,9 +632,9 @@ elf_object_p (bfd *abfd)
55+
56+
/* Read the first section header at index 0, and convert to internal
57+
form. */
58+
- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
59+
+ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
60+
+ || !elf_swap_shdr_in (abfd, &x_shdr, &i_shdr))
61+
goto got_no_match;
62+
- elf_swap_shdr_in (abfd, &x_shdr, &i_shdr);
63+
64+
/* If the section count is zero, the actual count is in the first
65+
section header. */
66+
@@ -716,9 +720,9 @@ elf_object_p (bfd *abfd)
67+
to internal form. */
68+
for (shindex = 1; shindex < i_ehdrp->e_shnum; shindex++)
69+
{
70+
- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
71+
+ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
72+
+ || !elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex))
73+
goto got_no_match;
74+
- elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex);
75+
76+
/* Sanity check sh_link and sh_info. */
77+
if (i_shdrp[shindex].sh_link >= num_sec)
78+
--
79+
2.45.4
80+

SPECS/binutils/binutils.spec

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,13 @@
2121
Summary: Contains a linker, an assembler, and other tools
2222
Name: binutils
2323
Version: 2.37
24-
Release: 18%{?dist}
24+
Release: 19%{?dist}
2525
License: GPLv2+
2626
Vendor: Microsoft Corporation
2727
Distribution: Mariner
2828
Group: System Environment/Base
2929
URL: https://www.gnu.org/software/binutils
30-
Source0: https://ftp.gnu.org/gnu/binutils/%{name}-%{version}.tar.xz
30+
Source0: https://sourceware.org/pub/binutils/releases/%{name}-%{version}.tar.xz
3131
# Patch was derived from source: https://src.fedoraproject.org/rpms/binutils/blob/f34/f/binutils-export-demangle.h.patch
3232
Patch0: export-demangle-header.patch
3333
# Patch1 Source https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=6b86da53d5ee2022b9065f445d23356190380746
@@ -58,6 +58,8 @@ Patch23: CVE-2025-7546.patch
5858
Patch24: CVE-2025-8225.patch
5959
Patch25: CVE-2025-11412.patch
6060
Patch26: CVE-2025-11414.patch
61+
Patch27: CVE-2025-11082.patch
62+
Patch28: CVE-2025-11083.patch
6163
Provides: bundled(libiberty)
6264

6365
# Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -314,6 +316,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
314316
%do_files aarch64-linux-gnu %{build_aarch64}
315317

316318
%changelog
319+
* Thu Oct 23 2025 Azure Linux Security Servicing Account <[email protected]> - 2.37-19
320+
- Patch for CVE-2025-11083, CVE-2025-11082
321+
317322
* Thu Oct 16 2025 Azure Linux Security Servicing Account <[email protected]> - 2.37-18
318323
- Patch for CVE-2025-11414, CVE-2025-11412
319324

cgmanifest.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1108,7 +1108,7 @@
11081108
"other": {
11091109
"name": "binutils",
11101110
"version": "2.37",
1111-
"downloadUrl": "https://ftp.gnu.org/gnu/binutils/binutils-2.37.tar.xz"
1111+
"downloadUrl": "https://sourceware.org/pub/binutils/releases/binutils-2.37.tar.xz"
11121112
}
11131113
}
11141114
},

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.aarch64.rpm
1212
file-5.40-3.cm2.aarch64.rpm
1313
file-devel-5.40-3.cm2.aarch64.rpm
1414
file-libs-5.40-3.cm2.aarch64.rpm
15-
binutils-2.37-18.cm2.aarch64.rpm
16-
binutils-devel-2.37-18.cm2.aarch64.rpm
15+
binutils-2.37-19.cm2.aarch64.rpm
16+
binutils-devel-2.37-19.cm2.aarch64.rpm
1717
gmp-6.2.1-4.cm2.aarch64.rpm
1818
gmp-devel-6.2.1-4.cm2.aarch64.rpm
1919
mpfr-4.1.0-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.x86_64.rpm
1212
file-5.40-3.cm2.x86_64.rpm
1313
file-devel-5.40-3.cm2.x86_64.rpm
1414
file-libs-5.40-3.cm2.x86_64.rpm
15-
binutils-2.37-18.cm2.x86_64.rpm
16-
binutils-devel-2.37-18.cm2.x86_64.rpm
15+
binutils-2.37-19.cm2.x86_64.rpm
16+
binutils-devel-2.37-19.cm2.x86_64.rpm
1717
gmp-6.2.1-4.cm2.x86_64.rpm
1818
gmp-devel-6.2.1-4.cm2.x86_64.rpm
1919
mpfr-4.1.0-2.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ bash-5.1.8-4.cm2.aarch64.rpm
99
bash-debuginfo-5.1.8-4.cm2.aarch64.rpm
1010
bash-devel-5.1.8-4.cm2.aarch64.rpm
1111
bash-lang-5.1.8-4.cm2.aarch64.rpm
12-
binutils-2.37-18.cm2.aarch64.rpm
13-
binutils-debuginfo-2.37-18.cm2.aarch64.rpm
14-
binutils-devel-2.37-18.cm2.aarch64.rpm
12+
binutils-2.37-19.cm2.aarch64.rpm
13+
binutils-debuginfo-2.37-19.cm2.aarch64.rpm
14+
binutils-devel-2.37-19.cm2.aarch64.rpm
1515
bison-3.7.6-2.cm2.aarch64.rpm
1616
bison-debuginfo-3.7.6-2.cm2.aarch64.rpm
1717
bzip2-1.0.8-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ bash-5.1.8-4.cm2.x86_64.rpm
99
bash-debuginfo-5.1.8-4.cm2.x86_64.rpm
1010
bash-devel-5.1.8-4.cm2.x86_64.rpm
1111
bash-lang-5.1.8-4.cm2.x86_64.rpm
12-
binutils-2.37-18.cm2.x86_64.rpm
13-
binutils-aarch64-linux-gnu-2.37-18.cm2.x86_64.rpm
14-
binutils-debuginfo-2.37-18.cm2.x86_64.rpm
15-
binutils-devel-2.37-18.cm2.x86_64.rpm
12+
binutils-2.37-19.cm2.x86_64.rpm
13+
binutils-aarch64-linux-gnu-2.37-19.cm2.x86_64.rpm
14+
binutils-debuginfo-2.37-19.cm2.x86_64.rpm
15+
binutils-devel-2.37-19.cm2.x86_64.rpm
1616
bison-3.7.6-2.cm2.x86_64.rpm
1717
bison-debuginfo-3.7.6-2.cm2.x86_64.rpm
1818
bzip2-1.0.8-1.cm2.x86_64.rpm
@@ -47,7 +47,7 @@ cracklib-lang-2.9.7-5.cm2.x86_64.rpm
4747
createrepo_c-0.17.5-1.cm2.x86_64.rpm
4848
createrepo_c-debuginfo-0.17.5-1.cm2.x86_64.rpm
4949
createrepo_c-devel-0.17.5-1.cm2.x86_64.rpm
50-
cross-binutils-common-2.37-18.cm2.noarch.rpm
50+
cross-binutils-common-2.37-19.cm2.noarch.rpm
5151
cross-gcc-common-11.2.0-8.cm2.noarch.rpm
5252
curl-8.8.0-7.cm2.x86_64.rpm
5353
curl-debuginfo-8.8.0-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)