Skip to content

Commit 2e52156

Browse files
azurelinux-securityKshitiz Godara
andauthored
[AutoPR- Security] Patch cmake for CVE-2025-9301 [LOW] (microsoft#14561)
Co-authored-by: Kshitiz Godara <[email protected]>
1 parent d3dd71c commit 2e52156

File tree

4 files changed

+74
-5
lines changed

4 files changed

+74
-5
lines changed

SPECS/cmake/CVE-2025-9301.patch

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
From 14476476add4462cc10e3fb2b0364b390cf002eb Mon Sep 17 00:00:00 2001
2+
From: Tyler Yankee <[email protected]>
3+
Date: Wed, 13 Aug 2025 15:22:28 -0400
4+
Subject: [PATCH] foreach: Explicitly skip replay without iterations
5+
6+
As written, foreach loops with a trailing `IN` (i.e., no loop
7+
variable(s) given) lead to an assertion error. Handle this case by
8+
exiting early when we know the loop won't execute anything.
9+
10+
Fixes: #27135
11+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
12+
Upstream-reference: https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8.patch
13+
---
14+
Source/cmForEachCommand.cxx | 3 +++
15+
Tests/RunCMake/foreach/RunCMakeTest.cmake | 1 +
16+
Tests/RunCMake/foreach/TrailingIn-result.txt | 1 +
17+
Tests/RunCMake/foreach/TrailingIn.cmake | 5 +++++
18+
4 files changed, 10 insertions(+)
19+
create mode 100644 Tests/RunCMake/foreach/TrailingIn-result.txt
20+
create mode 100644 Tests/RunCMake/foreach/TrailingIn.cmake
21+
22+
diff --git a/Source/cmForEachCommand.cxx b/Source/cmForEachCommand.cxx
23+
index 4845a6d0..825c7e0d 100644
24+
--- a/Source/cmForEachCommand.cxx
25+
+++ b/Source/cmForEachCommand.cxx
26+
@@ -99,6 +99,9 @@ bool cmForEachFunctionBlocker::ArgumentsMatch(cmListFileFunction const& lff,
27+
bool cmForEachFunctionBlocker::Replay(
28+
std::vector<cmListFileFunction> functions, cmExecutionStatus& inStatus)
29+
{
30+
+ if (this->Args.size() == this->IterationVarsCount) {
31+
+ return true;
32+
+ }
33+
return this->ZipLists ? this->ReplayZipLists(functions, inStatus)
34+
: this->ReplayItems(functions, inStatus);
35+
}
36+
diff --git a/Tests/RunCMake/foreach/RunCMakeTest.cmake b/Tests/RunCMake/foreach/RunCMakeTest.cmake
37+
index 15ca4770..acfc742e 100644
38+
--- a/Tests/RunCMake/foreach/RunCMakeTest.cmake
39+
+++ b/Tests/RunCMake/foreach/RunCMakeTest.cmake
40+
@@ -22,3 +22,4 @@ run_cmake(foreach-RANGE-invalid-test)
41+
run_cmake(foreach-RANGE-out-of-range-test)
42+
run_cmake(foreach-var-scope-CMP0124-OLD)
43+
run_cmake(foreach-var-scope-CMP0124-NEW)
44+
+run_cmake(TrailingIn)
45+
diff --git a/Tests/RunCMake/foreach/TrailingIn-result.txt b/Tests/RunCMake/foreach/TrailingIn-result.txt
46+
new file mode 100644
47+
index 00000000..573541ac
48+
--- /dev/null
49+
+++ b/Tests/RunCMake/foreach/TrailingIn-result.txt
50+
@@ -0,0 +1 @@
51+
+0
52+
diff --git a/Tests/RunCMake/foreach/TrailingIn.cmake b/Tests/RunCMake/foreach/TrailingIn.cmake
53+
new file mode 100644
54+
index 00000000..e2b5b2f2
55+
--- /dev/null
56+
+++ b/Tests/RunCMake/foreach/TrailingIn.cmake
57+
@@ -0,0 +1,5 @@
58+
+foreach(v IN)
59+
+endforeach()
60+
+
61+
+foreach(v1 v2 IN)
62+
+endforeach()
63+
--
64+
2.45.4
65+

SPECS/cmake/cmake.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.21.4
5-
Release: 18%{?dist}
5+
Release: 19%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -36,6 +36,7 @@ Patch21: CVE-2024-11053.patch
3636
Patch22: CVE-2024-9681.patch
3737
Patch23: CVE-2024-48615.patch
3838
Patch24: CVE-2024-8096.patch
39+
Patch25: CVE-2025-9301.patch
3940
BuildRequires: bzip2
4041
BuildRequires: bzip2-devel
4142
BuildRequires: curl
@@ -101,6 +102,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
101102
%{_prefix}/doc/%{name}-*/*
102103

103104
%changelog
105+
* Fri Aug 22 2025 Azure Linux Security Servicing Account <[email protected]> - 3.21.4-19
106+
- Patch for CVE-2025-9301
107+
104108
* Mon May 12 2025 Archana Shettigar <[email protected]> - 3.21.4-18
105109
- Fix CVE-2024-8096 by backporting
106110

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm
3030
chkconfig-1.20-4.cm2.aarch64.rpm
3131
chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm
3232
chkconfig-lang-1.20-4.cm2.aarch64.rpm
33-
cmake-3.21.4-18.cm2.aarch64.rpm
34-
cmake-debuginfo-3.21.4-18.cm2.aarch64.rpm
33+
cmake-3.21.4-19.cm2.aarch64.rpm
34+
cmake-debuginfo-3.21.4-19.cm2.aarch64.rpm
3535
coreutils-8.32-7.cm2.aarch64.rpm
3636
coreutils-debuginfo-8.32-7.cm2.aarch64.rpm
3737
coreutils-lang-8.32-7.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm
3131
chkconfig-1.20-4.cm2.x86_64.rpm
3232
chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm
3333
chkconfig-lang-1.20-4.cm2.x86_64.rpm
34-
cmake-3.21.4-18.cm2.x86_64.rpm
35-
cmake-debuginfo-3.21.4-18.cm2.x86_64.rpm
34+
cmake-3.21.4-19.cm2.x86_64.rpm
35+
cmake-debuginfo-3.21.4-19.cm2.x86_64.rpm
3636
coreutils-8.32-7.cm2.x86_64.rpm
3737
coreutils-debuginfo-8.32-7.cm2.x86_64.rpm
3838
coreutils-lang-8.32-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)