Skip to content

Commit 44a8a35

Browse files
azurelinux-securityKanishk Bansal
andauthored
[AutoPR- Security] Patch binutils for CVE-2025-11414, CVE-2025-11412 [MEDIUM] (microsoft#14886)
Co-authored-by: Kanishk Bansal <[email protected]>
1 parent a099703 commit 44a8a35

File tree

7 files changed

+140
-13
lines changed

7 files changed

+140
-13
lines changed
Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From eee96bd5f9200a9b74df45fd6ae116bad7417236 Mon Sep 17 00:00:00 2001
2+
From: Alan Modra <[email protected]>
3+
Date: Thu, 25 Sep 2025 08:22:24 +0930
4+
Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry
5+
6+
Limit addends on vtentry relocs, otherwise ld might attempt to
7+
allocate a stupidly large array. This also fixes the expression
8+
overflow leading to pr33452. A vtable of 33M entries on a 64-bit
9+
host is surely large enough, especially considering that VTINHERIT
10+
and VTENTRY relocations are to support -fvtable-gc that disappeared
11+
from gcc over 20 years ago.
12+
13+
PR ld/33452
14+
* elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend.
15+
16+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
17+
Upstream-reference: https://github.com/bminor/binutils-gdb/commit/047435dd988a3975d40c6626a8f739a0b2e154bc.patch
18+
---
19+
bfd/elflink.c | 2 +-
20+
1 file changed, 1 insertion(+), 1 deletion(-)
21+
22+
diff --git a/bfd/elflink.c b/bfd/elflink.c
23+
index 51790953..37caba7e 100644
24+
--- a/bfd/elflink.c
25+
+++ b/bfd/elflink.c
26+
@@ -14235,7 +14235,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec,
27+
const struct elf_backend_data *bed = get_elf_backend_data (abfd);
28+
unsigned int log_file_align = bed->s->log_file_align;
29+
30+
- if (!h)
31+
+ if (!h || addend > 1u << 28)
32+
{
33+
/* xgettext:c-format */
34+
_bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),
35+
--
36+
2.45.4
37+
Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
From 576abdc0a868acbcf0d363c720e4d6eaf25b3089 Mon Sep 17 00:00:00 2001
2+
From: "H.J. Lu" <[email protected]>
3+
Date: Tue, 23 Sep 2025 08:52:26 +0800
4+
Subject: [PATCH] elf: Return error on unsorted symbol table if not allowed
5+
6+
Normally ELF symbol table should be sorted, i.e., local symbols precede
7+
global symbols. Irix 6 is an exception and its elf_bad_symtab is set
8+
to true. Issue an error if elf_bad_symtab is false and symbol table is
9+
unsorted.
10+
11+
PR ld/33450
12+
* elflink.c (set_symbol_value): Change return type to bool and
13+
return false on error. Issue an error on unsorted symbol table
14+
if not allowed.
15+
(elf_link_input_bfd): Return false if set_symbol_value reurns
16+
false.
17+
18+
Signed-off-by: H.J. Lu <[email protected]>
19+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
20+
Upstream-reference: https://github.com/bminor/binutils-gdb/commit/aeaaa9af6359c8e394ce9cf24911fec4f4d23703.patch
21+
---
22+
bfd/elflink.c | 21 +++++++++++++++------
23+
1 file changed, 15 insertions(+), 6 deletions(-)
24+
25+
diff --git a/bfd/elflink.c b/bfd/elflink.c
26+
index 37caba7e..b841a750 100644
27+
--- a/bfd/elflink.c
28+
+++ b/bfd/elflink.c
29+
@@ -8623,7 +8623,7 @@ struct elf_outext_info
30+
<binary-operator> := as in C
31+
<unary-operator> := as in C, plus "0-" for unambiguous negation. */
32+
33+
-static void
34+
+static bool
35+
set_symbol_value (bfd *bfd_with_globals,
36+
Elf_Internal_Sym *isymbuf,
37+
size_t locsymcount,
38+
@@ -8644,9 +8644,15 @@ set_symbol_value (bfd *bfd_with_globals,
39+
"absolute" section and give it a value. */
40+
sym->st_shndx = SHN_ABS;
41+
sym->st_value = val;
42+
- return;
43+
+ return true;
44+
+ }
45+
+ if (!elf_bad_symtab (bfd_with_globals))
46+
+ {
47+
+ _bfd_error_handler (_("%pB: corrupt symbol table"),
48+
+ bfd_with_globals);
49+
+ bfd_set_error (bfd_error_bad_value);
50+
+ return false;
51+
}
52+
- BFD_ASSERT (elf_bad_symtab (bfd_with_globals));
53+
extsymoff = 0;
54+
}
55+
56+
@@ -8656,11 +8662,12 @@ set_symbol_value (bfd *bfd_with_globals,
57+
if (h == NULL)
58+
{
59+
/* FIXMEL What should we do ? */
60+
- return;
61+
+ return false;
62+
}
63+
h->root.type = bfd_link_hash_defined;
64+
h->root.u.def.value = val;
65+
h->root.u.def.section = bfd_abs_section_ptr;
66+
+ return true;
67+
}
68+
69+
static bool
70+
@@ -11369,8 +11376,10 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
71+
return false;
72+
73+
/* Symbol evaluated OK. Update to absolute value. */
74+
- set_symbol_value (input_bfd, isymbuf, locsymcount,
75+
- r_symndx, val);
76+
+ if (!set_symbol_value (input_bfd, isymbuf, locsymcount, r_symndx,
77+
+ val))
78+
+ return false;
79+
+
80+
continue;
81+
}
82+
83+
--
84+
2.45.4
85+

SPECS/binutils/binutils.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: Contains a linker, an assembler, and other tools
2222
Name: binutils
2323
Version: 2.37
24-
Release: 17%{?dist}
24+
Release: 18%{?dist}
2525
License: GPLv2+
2626
Vendor: Microsoft Corporation
2727
Distribution: Mariner
@@ -56,6 +56,8 @@ Patch21: CVE-2025-5244.patch
5656
Patch22: CVE-2025-7545.patch
5757
Patch23: CVE-2025-7546.patch
5858
Patch24: CVE-2025-8225.patch
59+
Patch25: CVE-2025-11412.patch
60+
Patch26: CVE-2025-11414.patch
5961
Provides: bundled(libiberty)
6062

6163
# Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -312,6 +314,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
312314
%do_files aarch64-linux-gnu %{build_aarch64}
313315

314316
%changelog
317+
* Thu Oct 16 2025 Azure Linux Security Servicing Account <[email protected]> - 2.37-18
318+
- Patch for CVE-2025-11414, CVE-2025-11412
319+
315320
* Mon Jul 28 2025 Azure Linux Security Servicing Account <[email protected]> - 2.37-17
316321
- Patch for CVE-2025-8225
317322

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.aarch64.rpm
1212
file-5.40-3.cm2.aarch64.rpm
1313
file-devel-5.40-3.cm2.aarch64.rpm
1414
file-libs-5.40-3.cm2.aarch64.rpm
15-
binutils-2.37-17.cm2.aarch64.rpm
16-
binutils-devel-2.37-17.cm2.aarch64.rpm
15+
binutils-2.37-18.cm2.aarch64.rpm
16+
binutils-devel-2.37-18.cm2.aarch64.rpm
1717
gmp-6.2.1-4.cm2.aarch64.rpm
1818
gmp-devel-6.2.1-4.cm2.aarch64.rpm
1919
mpfr-4.1.0-2.cm2.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.x86_64.rpm
1212
file-5.40-3.cm2.x86_64.rpm
1313
file-devel-5.40-3.cm2.x86_64.rpm
1414
file-libs-5.40-3.cm2.x86_64.rpm
15-
binutils-2.37-17.cm2.x86_64.rpm
16-
binutils-devel-2.37-17.cm2.x86_64.rpm
15+
binutils-2.37-18.cm2.x86_64.rpm
16+
binutils-devel-2.37-18.cm2.x86_64.rpm
1717
gmp-6.2.1-4.cm2.x86_64.rpm
1818
gmp-devel-6.2.1-4.cm2.x86_64.rpm
1919
mpfr-4.1.0-2.cm2.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ bash-5.1.8-4.cm2.aarch64.rpm
99
bash-debuginfo-5.1.8-4.cm2.aarch64.rpm
1010
bash-devel-5.1.8-4.cm2.aarch64.rpm
1111
bash-lang-5.1.8-4.cm2.aarch64.rpm
12-
binutils-2.37-17.cm2.aarch64.rpm
13-
binutils-debuginfo-2.37-17.cm2.aarch64.rpm
14-
binutils-devel-2.37-17.cm2.aarch64.rpm
12+
binutils-2.37-18.cm2.aarch64.rpm
13+
binutils-debuginfo-2.37-18.cm2.aarch64.rpm
14+
binutils-devel-2.37-18.cm2.aarch64.rpm
1515
bison-3.7.6-2.cm2.aarch64.rpm
1616
bison-debuginfo-3.7.6-2.cm2.aarch64.rpm
1717
bzip2-1.0.8-1.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ bash-5.1.8-4.cm2.x86_64.rpm
99
bash-debuginfo-5.1.8-4.cm2.x86_64.rpm
1010
bash-devel-5.1.8-4.cm2.x86_64.rpm
1111
bash-lang-5.1.8-4.cm2.x86_64.rpm
12-
binutils-2.37-17.cm2.x86_64.rpm
13-
binutils-aarch64-linux-gnu-2.37-17.cm2.x86_64.rpm
14-
binutils-debuginfo-2.37-17.cm2.x86_64.rpm
15-
binutils-devel-2.37-17.cm2.x86_64.rpm
12+
binutils-2.37-18.cm2.x86_64.rpm
13+
binutils-aarch64-linux-gnu-2.37-18.cm2.x86_64.rpm
14+
binutils-debuginfo-2.37-18.cm2.x86_64.rpm
15+
binutils-devel-2.37-18.cm2.x86_64.rpm
1616
bison-3.7.6-2.cm2.x86_64.rpm
1717
bison-debuginfo-3.7.6-2.cm2.x86_64.rpm
1818
bzip2-1.0.8-1.cm2.x86_64.rpm
@@ -47,7 +47,7 @@ cracklib-lang-2.9.7-5.cm2.x86_64.rpm
4747
createrepo_c-0.17.5-1.cm2.x86_64.rpm
4848
createrepo_c-debuginfo-0.17.5-1.cm2.x86_64.rpm
4949
createrepo_c-devel-0.17.5-1.cm2.x86_64.rpm
50-
cross-binutils-common-2.37-17.cm2.noarch.rpm
50+
cross-binutils-common-2.37-18.cm2.noarch.rpm
5151
cross-gcc-common-11.2.0-8.cm2.noarch.rpm
5252
curl-8.8.0-7.cm2.x86_64.rpm
5353
curl-debuginfo-8.8.0-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)