Skip to content

Commit 9ceaefe

Browse files
[AutoPR- Security] Patch gdb for CVE-2025-11414, CVE-2025-11412 [MEDIUM] (microsoft#14931)
Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 9360fd9 commit 9ceaefe

File tree

3 files changed

+122
-1
lines changed

3 files changed

+122
-1
lines changed

SPECS/gdb/CVE-2025-11412.patch

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From 2a185e5ed66fd416622bcd23002f224855197ef2 Mon Sep 17 00:00:00 2001
2+
From: Alan Modra <[email protected]>
3+
Date: Thu, 25 Sep 2025 08:22:24 +0930
4+
Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry
5+
6+
Limit addends on vtentry relocs, otherwise ld might attempt to
7+
allocate a stupidly large array. This also fixes the expression
8+
overflow leading to pr33452. A vtable of 33M entries on a 64-bit
9+
host is surely large enough, especially considering that VTINHERIT
10+
and VTENTRY relocations are to support -fvtable-gc that disappeared
11+
from gcc over 20 years ago.
12+
13+
PR ld/33452
14+
* elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend.
15+
16+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
17+
Upstream-reference: https://github.com/bminor/binutils-gdb/commit/047435dd988a3975d40c6626a8f739a0b2e154bc.patch
18+
---
19+
bfd/elflink.c | 2 +-
20+
1 file changed, 1 insertion(+), 1 deletion(-)
21+
22+
diff --git a/bfd/elflink.c b/bfd/elflink.c
23+
index b22fd11..dc0267e 100644
24+
--- a/bfd/elflink.c
25+
+++ b/bfd/elflink.c
26+
@@ -14204,7 +14204,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec,
27+
const struct elf_backend_data *bed = get_elf_backend_data (abfd);
28+
unsigned int log_file_align = bed->s->log_file_align;
29+
30+
- if (!h)
31+
+ if (!h || addend > 1u << 28)
32+
{
33+
/* xgettext:c-format */
34+
_bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),
35+
--
36+
2.45.4
37+

SPECS/gdb/CVE-2025-11414.patch

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
From 82732e362aaf9eef36cdcabe4330b5304fa1ef8d Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Mon, 27 Oct 2025 09:26:13 +0000
4+
Subject: [PATCH] elf: Return error on unsorted symbol table if not allowed
5+
6+
Normally ELF symbol table should be sorted, i.e., local symbols precede
7+
global symbols. Irix 6 is an exception and its elf_bad_symtab is set
8+
to true. Issue an error if elf_bad_symtab is false and symbol table is
9+
unsorted.
10+
11+
\tPR ld/33450
12+
\t* elflink.c (set_symbol_value): Change return type to bool and
13+
\treturn false on error. Issue an error on unsorted symbol table
14+
\tif not allowed.
15+
\t(elf_link_input_bfd): Return false if set_symbol_value reurns
16+
\tfalse.
17+
18+
Signed-off-by: H.J. Lu <[email protected]>
19+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
20+
Upstream-reference: AI Backport of https://github.com/bminor/binutils-gdb/commit/aeaaa9af6359c8e394ce9cf24911fec4f4d23703.patch
21+
---
22+
bfd/elflink.c | 19 ++++++++++++++-----
23+
1 file changed, 14 insertions(+), 5 deletions(-)
24+
25+
diff --git a/bfd/elflink.c b/bfd/elflink.c
26+
index dc0267e..1a1a44e 100644
27+
--- a/bfd/elflink.c
28+
+++ b/bfd/elflink.c
29+
@@ -8596,7 +8596,7 @@ struct elf_outext_info
30+
<binary-operator> := as in C
31+
<unary-operator> := as in C, plus "0-" for unambiguous negation. */
32+
33+
-static void
34+
+static bool
35+
set_symbol_value (bfd *bfd_with_globals,
36+
Elf_Internal_Sym *isymbuf,
37+
size_t locsymcount,
38+
@@ -8618,9 +8618,15 @@ set_symbol_value (bfd *bfd_with_globals,
39+
"absolute" section and give it a value. */
40+
sym->st_shndx = SHN_ABS;
41+
sym->st_value = val;
42+
- return;
43+
+ return true;
44+
+ }
45+
+ if (!elf_bad_symtab (bfd_with_globals))
46+
+ {
47+
+ _bfd_error_handler (_("%pB: corrupt symbol table"),
48+
+ bfd_with_globals);
49+
+ bfd_set_error (bfd_error_bad_value);
50+
+ return false;
51+
}
52+
- BFD_ASSERT (elf_bad_symtab (bfd_with_globals));
53+
extsymoff = 0;
54+
}
55+
56+
@@ -8635,6 +8641,7 @@ set_symbol_value (bfd *bfd_with_globals,
57+
h->root.type = bfd_link_hash_defined;
58+
h->root.u.def.value = val;
59+
h->root.u.def.section = bfd_abs_section_ptr;
60+
+ return true;
61+
}
62+
63+
static bool
64+
@@ -11338,8 +11345,10 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
65+
return false;
66+
67+
/* Symbol evaluated OK. Update to absolute value. */
68+
- set_symbol_value (input_bfd, isymbuf, locsymcount,
69+
- r_symndx, val);
70+
+ if (!set_symbol_value (input_bfd, isymbuf, locsymcount, r_symndx,
71+
+ val))
72+
+ return false;
73+
+
74+
continue;
75+
}
76+
77+
--
78+
2.45.4
79+

SPECS/gdb/gdb.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: C debugger
22
Name: gdb
33
Version: 11.2
4-
Release: 9%{?dist}
4+
Release: 10%{?dist}
55
License: GPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -23,6 +23,8 @@ Patch11: CVE-2025-11083.patch
2323
Patch12: CVE-2021-32256.patch
2424
Patch13: fix-infinite-recursion.patch
2525
Patch14: CVE-2025-5244.patch
26+
Patch15: CVE-2025-11412.patch
27+
Patch16: CVE-2025-11414.patch
2628
BuildRequires: expat-devel
2729
BuildRequires: gcc-c++
2830
BuildRequires: gcc-gfortran
@@ -107,6 +109,9 @@ rm -rvf libctf/testsuite
107109
%{_mandir}/*/*
108110

109111
%changelog
112+
* Mon Oct 27 2025 Azure Linux Security Servicing Account <[email protected]> - 11.2-10
113+
- Patch for CVE-2025-11414, CVE-2025-11412
114+
110115
* Mon Oct 27 2025 Archana Shettigar <[email protected]> - 11.2-9
111116
- Patch CVE-2021-32256 & CVE-2025-5244 using an upstream patch
112117

0 commit comments

Comments
 (0)