Skip to content

Commit 8e33b9d

Browse files
azurelinux-securityKanishk Bansal
andauthored
[AutoPR- Security] Patch binutils for CVE-2025-11414, CVE-2025-11412 [MEDIUM] (microsoft#14885)
Co-authored-by: Kanishk Bansal <[email protected]>
1 parent e2b84da commit 8e33b9d

File tree

7 files changed

+140
-13
lines changed

7 files changed

+140
-13
lines changed
Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From fc99e514c408a988c8d540bafed93b4214f629c2 Mon Sep 17 00:00:00 2001
2+
From: Alan Modra <[email protected]>
3+
Date: Thu, 25 Sep 2025 08:22:24 +0930
4+
Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry
5+
6+
Limit addends on vtentry relocs, otherwise ld might attempt to
7+
allocate a stupidly large array. This also fixes the expression
8+
overflow leading to pr33452. A vtable of 33M entries on a 64-bit
9+
host is surely large enough, especially considering that VTINHERIT
10+
and VTENTRY relocations are to support -fvtable-gc that disappeared
11+
from gcc over 20 years ago.
12+
13+
PR ld/33452
14+
* elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend.
15+
16+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
17+
Upstream-reference: https://github.com/bminor/binutils-gdb/commit/047435dd988a3975d40c6626a8f739a0b2e154bc.patch
18+
---
19+
bfd/elflink.c | 2 +-
20+
1 file changed, 1 insertion(+), 1 deletion(-)
21+
22+
diff --git a/bfd/elflink.c b/bfd/elflink.c
23+
index be2a2f53..3ec41fd5 100644
24+
--- a/bfd/elflink.c
25+
+++ b/bfd/elflink.c
26+
@@ -14536,7 +14536,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec,
27+
const struct elf_backend_data *bed = get_elf_backend_data (abfd);
28+
unsigned int log_file_align = bed->s->log_file_align;
29+
30+
- if (!h)
31+
+ if (!h || addend > 1u << 28)
32+
{
33+
/* xgettext:c-format */
34+
_bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),
35+
--
36+
2.45.4
37+
Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
From 03c88b26a6d9cedb201699e435fe685e5131a33e Mon Sep 17 00:00:00 2001
2+
From: "H.J. Lu" <[email protected]>
3+
Date: Tue, 23 Sep 2025 08:52:26 +0800
4+
Subject: [PATCH] elf: Return error on unsorted symbol table if not allowed
5+
6+
Normally ELF symbol table should be sorted, i.e., local symbols precede
7+
global symbols. Irix 6 is an exception and its elf_bad_symtab is set
8+
to true. Issue an error if elf_bad_symtab is false and symbol table is
9+
unsorted.
10+
11+
PR ld/33450
12+
* elflink.c (set_symbol_value): Change return type to bool and
13+
return false on error. Issue an error on unsorted symbol table
14+
if not allowed.
15+
(elf_link_input_bfd): Return false if set_symbol_value reurns
16+
false.
17+
18+
Signed-off-by: H.J. Lu <[email protected]>
19+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
20+
Upstream-reference: https://github.com/bminor/binutils-gdb/commit/aeaaa9af6359c8e394ce9cf24911fec4f4d23703.patch
21+
---
22+
bfd/elflink.c | 21 +++++++++++++++------
23+
1 file changed, 15 insertions(+), 6 deletions(-)
24+
25+
diff --git a/bfd/elflink.c b/bfd/elflink.c
26+
index 3ec41fd5..1a86f9d2 100644
27+
--- a/bfd/elflink.c
28+
+++ b/bfd/elflink.c
29+
@@ -8846,7 +8846,7 @@ struct elf_outext_info
30+
<binary-operator> := as in C
31+
<unary-operator> := as in C, plus "0-" for unambiguous negation. */
32+
33+
-static void
34+
+static bool
35+
set_symbol_value (bfd *bfd_with_globals,
36+
Elf_Internal_Sym *isymbuf,
37+
size_t locsymcount,
38+
@@ -8867,9 +8867,15 @@ set_symbol_value (bfd *bfd_with_globals,
39+
"absolute" section and give it a value. */
40+
sym->st_shndx = SHN_ABS;
41+
sym->st_value = val;
42+
- return;
43+
+ return true;
44+
+ }
45+
+ if (!elf_bad_symtab (bfd_with_globals))
46+
+ {
47+
+ _bfd_error_handler (_("%pB: corrupt symbol table"),
48+
+ bfd_with_globals);
49+
+ bfd_set_error (bfd_error_bad_value);
50+
+ return false;
51+
}
52+
- BFD_ASSERT (elf_bad_symtab (bfd_with_globals));
53+
extsymoff = 0;
54+
}
55+
56+
@@ -8879,11 +8885,12 @@ set_symbol_value (bfd *bfd_with_globals,
57+
if (h == NULL)
58+
{
59+
/* FIXMEL What should we do ? */
60+
- return;
61+
+ return false;
62+
}
63+
h->root.type = bfd_link_hash_defined;
64+
h->root.u.def.value = val;
65+
h->root.u.def.section = bfd_abs_section_ptr;
66+
+ return true;
67+
}
68+
69+
static bool
70+
@@ -11573,8 +11580,10 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
71+
return false;
72+
73+
/* Symbol evaluated OK. Update to absolute value. */
74+
- set_symbol_value (input_bfd, isymbuf, locsymcount,
75+
- r_symndx, val);
76+
+ if (!set_symbol_value (input_bfd, isymbuf, locsymcount, r_symndx,
77+
+ val))
78+
+ return false;
79+
+
80+
continue;
81+
}
82+
83+
--
84+
2.45.4
85+

SPECS/binutils/binutils.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: Contains a linker, an assembler, and other tools
2222
Name: binutils
2323
Version: 2.41
24-
Release: 9%{?dist}
24+
Release: 10%{?dist}
2525
License: GPLv2+
2626
Vendor: Microsoft Corporation
2727
Distribution: Azure Linux
@@ -45,6 +45,8 @@ Patch11: CVE-2025-7545.patch
4545
Patch12: CVE-2025-8225.patch
4646
Patch13: CVE-2025-11082.patch
4747
Patch14: CVE-2025-11083.patch
48+
Patch15: CVE-2025-11412.patch
49+
Patch16: CVE-2025-11414.patch
4850
Provides: bundled(libiberty)
4951

5052
# Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -334,6 +336,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
334336
%do_files aarch64-linux-gnu %{build_aarch64}
335337

336338
%changelog
339+
* Thu Oct 16 2025 Azure Linux Security Servicing Account <[email protected]> - 2.41-10
340+
- Patch for CVE-2025-11414, CVE-2025-11412
341+
337342
* Wed Oct 01 2025 Azure Linux Security Servicing Account <[email protected]> - 2.41-9
338343
- Patch for CVE-2025-11083, CVE-2025-11082
339344

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.aarch64.rpm
1313
file-5.45-1.azl3.aarch64.rpm
1414
file-devel-5.45-1.azl3.aarch64.rpm
1515
file-libs-5.45-1.azl3.aarch64.rpm
16-
binutils-2.41-9.azl3.aarch64.rpm
17-
binutils-devel-2.41-9.azl3.aarch64.rpm
16+
binutils-2.41-10.azl3.aarch64.rpm
17+
binutils-devel-2.41-10.azl3.aarch64.rpm
1818
gmp-6.3.0-1.azl3.aarch64.rpm
1919
gmp-devel-6.3.0-1.azl3.aarch64.rpm
2020
mpfr-4.2.1-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.x86_64.rpm
1313
file-5.45-1.azl3.x86_64.rpm
1414
file-devel-5.45-1.azl3.x86_64.rpm
1515
file-libs-5.45-1.azl3.x86_64.rpm
16-
binutils-2.41-9.azl3.x86_64.rpm
17-
binutils-devel-2.41-9.azl3.x86_64.rpm
16+
binutils-2.41-10.azl3.x86_64.rpm
17+
binutils-devel-2.41-10.azl3.x86_64.rpm
1818
gmp-6.3.0-1.azl3.x86_64.rpm
1919
gmp-devel-6.3.0-1.azl3.x86_64.rpm
2020
mpfr-4.2.1-1.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ bash-5.2.15-3.azl3.aarch64.rpm
3030
bash-debuginfo-5.2.15-3.azl3.aarch64.rpm
3131
bash-devel-5.2.15-3.azl3.aarch64.rpm
3232
bash-lang-5.2.15-3.azl3.aarch64.rpm
33-
binutils-2.41-9.azl3.aarch64.rpm
34-
binutils-debuginfo-2.41-9.azl3.aarch64.rpm
35-
binutils-devel-2.41-9.azl3.aarch64.rpm
33+
binutils-2.41-10.azl3.aarch64.rpm
34+
binutils-debuginfo-2.41-10.azl3.aarch64.rpm
35+
binutils-devel-2.41-10.azl3.aarch64.rpm
3636
bison-3.8.2-1.azl3.aarch64.rpm
3737
bison-debuginfo-3.8.2-1.azl3.aarch64.rpm
3838
bzip2-1.0.8-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ bash-5.2.15-3.azl3.x86_64.rpm
3232
bash-debuginfo-5.2.15-3.azl3.x86_64.rpm
3333
bash-devel-5.2.15-3.azl3.x86_64.rpm
3434
bash-lang-5.2.15-3.azl3.x86_64.rpm
35-
binutils-2.41-9.azl3.x86_64.rpm
36-
binutils-aarch64-linux-gnu-2.41-9.azl3.x86_64.rpm
37-
binutils-debuginfo-2.41-9.azl3.x86_64.rpm
38-
binutils-devel-2.41-9.azl3.x86_64.rpm
35+
binutils-2.41-10.azl3.x86_64.rpm
36+
binutils-aarch64-linux-gnu-2.41-10.azl3.x86_64.rpm
37+
binutils-debuginfo-2.41-10.azl3.x86_64.rpm
38+
binutils-devel-2.41-10.azl3.x86_64.rpm
3939
bison-3.8.2-1.azl3.x86_64.rpm
4040
bison-debuginfo-3.8.2-1.azl3.x86_64.rpm
4141
bzip2-1.0.8-1.azl3.x86_64.rpm
@@ -70,7 +70,7 @@ cracklib-lang-2.9.11-1.azl3.x86_64.rpm
7070
createrepo_c-1.0.3-1.azl3.x86_64.rpm
7171
createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm
7272
createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm
73-
cross-binutils-common-2.41-9.azl3.noarch.rpm
73+
cross-binutils-common-2.41-10.azl3.noarch.rpm
7474
cross-gcc-common-13.2.0-7.azl3.noarch.rpm
7575
curl-8.11.1-4.azl3.x86_64.rpm
7676
curl-debuginfo-8.11.1-4.azl3.x86_64.rpm

0 commit comments

Comments
 (0)