Skip to content

Commit a387225

Browse files
azurelinux-securitykevin-b-lockwood
azurelinux-security
and
kevin-b-lockwood
authored
[AutoPR- Security] Patch binutils for CVE-2025-7546, CVE-2025-7545 [MEDIUM] (microsoft#14331)
Co-authored-by: Kevin Lockwood <[email protected]>
1 parent 6ec72b3 commit a387225

File tree

7 files changed

+105
-13
lines changed

7 files changed

+105
-13
lines changed

‎SPECS/binutils/CVE-2025-7545.patch

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 255c74cb9030905028a4f9ce07aff56039844152 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 17 Jul 2025 08:46:38 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-7545 in binutils
6+
7+
Upstream Patch Reference: https://github.com/bminor/binutils-gdb/commit/08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944.patch
8+
---
9+
binutils/objcopy.c | 6 ++++++
10+
1 file changed, 6 insertions(+)
11+
12+
diff --git a/binutils/objcopy.c b/binutils/objcopy.c
13+
index 3569b890..c09d85d1 100644
14+
--- a/binutils/objcopy.c
15+
+++ b/binutils/objcopy.c
16+
@@ -4514,6 +4514,7 @@ copy_section (bfd *ibfd, sec_ptr isection, void *obfdarg)
17+
char *to = (char *) memhunk;
18+
char *end = (char *) memhunk + size;
19+
int i;
20+
+ bfd_size_type memhunk_size = size;
21+
22+
/* If the section address is not exactly divisible by the interleave,
23+
then we must bias the from address. If the copy_byte is less than
24+
@@ -4533,6 +4534,11 @@ copy_section (bfd *ibfd, sec_ptr isection, void *obfdarg)
25+
}
26+
27+
size = (size + interleave - 1 - copy_byte) / interleave * copy_width;
28+
+
29+
+ /* Don't extend the output section size. */
30+
+ if (size > memhunk_size)
31+
+ size = memhunk_size;
32+
+
33+
osection->lma /= interleave;
34+
if (copy_byte < extra)
35+
osection->lma++;
36+
--
37+
2.45.3
38+

‎SPECS/binutils/CVE-2025-7546.patch

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
From 35b1514eba18a239c85867ab4132408d85e1e120 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 17 Jul 2025 08:48:22 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-7546 in binutils
6+
7+
Upstream Patch Reference: https://github.com/bminor/binutils-gdb/commit/41461010eb7c79fee7a9d5f6209accdaac66cc6b.patch
8+
---
9+
bfd/elf.c | 23 ++++++++++-------------
10+
1 file changed, 10 insertions(+), 13 deletions(-)
11+
12+
diff --git a/bfd/elf.c b/bfd/elf.c
13+
index d38e0aff..1de0cec0 100644
14+
--- a/bfd/elf.c
15+
+++ b/bfd/elf.c
16+
@@ -4120,20 +4120,17 @@ bfd_elf_set_group_contents (bfd *abfd, asection *sec, void *failedptrarg)
17+
break;
18+
}
19+
20+
- /* We should always get here with loc == sec->contents + 4, but it is
21+
- possible to craft bogus SHT_GROUP sections that will cause segfaults
22+
- in objcopy without checking loc here and in the loop above. */
23+
- if (loc == sec->contents)
24+
- BFD_ASSERT (0);
25+
- else
26+
+ /* We should always get here with loc == sec->contents + 4. Return
27+
+ an error for bogus SHT_GROUP sections. */
28+
+ loc -= 4;
29+
+ if (loc != sec->contents)
30+
{
31+
- loc -= 4;
32+
- if (loc != sec->contents)
33+
- {
34+
- BFD_ASSERT (0);
35+
- memset (sec->contents + 4, 0, loc - sec->contents);
36+
- loc = sec->contents;
37+
- }
38+
+ /* xgettext:c-format */
39+
+ _bfd_error_handler (_("%pB: corrupted group section: `%pA'"),
40+
+ abfd, sec);
41+
+ bfd_set_error (bfd_error_bad_value);
42+
+ *failedptr = true;
43+
+ return;
44+
}
45+
46+
H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc);
47+
--
48+
2.45.3
49+

‎SPECS/binutils/binutils.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: Contains a linker, an assembler, and other tools
2222
Name: binutils
2323
Version: 2.41
24-
Release: 6%{?dist}
24+
Release: 7%{?dist}
2525
License: GPLv2+
2626
Vendor: Microsoft Corporation
2727
Distribution: Azure Linux
@@ -40,6 +40,8 @@ Patch6: CVE-2025-0840.patch
4040
Patch7: CVE-2025-1744.patch
4141
Patch8: CVE-2025-5245.patch
4242
Patch9: CVE-2025-5244.patch
43+
Patch10: CVE-2025-7546.patch
44+
Patch11: CVE-2025-7545.patch
4345
Provides: bundled(libiberty)
4446

4547
# Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -329,6 +331,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
329331
%do_files aarch64-linux-gnu %{build_aarch64}
330332

331333
%changelog
334+
* Thu Jul 17 2025 Azure Linux Security Servicing Account <[email protected]> - 2.41-7
335+
- Patch for CVE-2025-7546, CVE-2025-7545
336+
332337
* Wed May 28 2025 Akarsh Chaudhary <[email protected]> - 2.41-6
333338
- Patch CVE-2025-5245 , CVE-2025-5244
334339

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.aarch64.rpm
1313
file-5.45-1.azl3.aarch64.rpm
1414
file-devel-5.45-1.azl3.aarch64.rpm
1515
file-libs-5.45-1.azl3.aarch64.rpm
16-
binutils-2.41-6.azl3.aarch64.rpm
17-
binutils-devel-2.41-6.azl3.aarch64.rpm
16+
binutils-2.41-7.azl3.aarch64.rpm
17+
binutils-devel-2.41-7.azl3.aarch64.rpm
1818
gmp-6.3.0-1.azl3.aarch64.rpm
1919
gmp-devel-6.3.0-1.azl3.aarch64.rpm
2020
mpfr-4.2.1-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.x86_64.rpm
1313
file-5.45-1.azl3.x86_64.rpm
1414
file-devel-5.45-1.azl3.x86_64.rpm
1515
file-libs-5.45-1.azl3.x86_64.rpm
16-
binutils-2.41-6.azl3.x86_64.rpm
17-
binutils-devel-2.41-6.azl3.x86_64.rpm
16+
binutils-2.41-7.azl3.x86_64.rpm
17+
binutils-devel-2.41-7.azl3.x86_64.rpm
1818
gmp-6.3.0-1.azl3.x86_64.rpm
1919
gmp-devel-6.3.0-1.azl3.x86_64.rpm
2020
mpfr-4.2.1-1.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ bash-5.2.15-3.azl3.aarch64.rpm
3030
bash-debuginfo-5.2.15-3.azl3.aarch64.rpm
3131
bash-devel-5.2.15-3.azl3.aarch64.rpm
3232
bash-lang-5.2.15-3.azl3.aarch64.rpm
33-
binutils-2.41-6.azl3.aarch64.rpm
34-
binutils-debuginfo-2.41-6.azl3.aarch64.rpm
35-
binutils-devel-2.41-6.azl3.aarch64.rpm
33+
binutils-2.41-7.azl3.aarch64.rpm
34+
binutils-debuginfo-2.41-7.azl3.aarch64.rpm
35+
binutils-devel-2.41-7.azl3.aarch64.rpm
3636
bison-3.8.2-1.azl3.aarch64.rpm
3737
bison-debuginfo-3.8.2-1.azl3.aarch64.rpm
3838
bzip2-1.0.8-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ bash-5.2.15-3.azl3.x86_64.rpm
3232
bash-debuginfo-5.2.15-3.azl3.x86_64.rpm
3333
bash-devel-5.2.15-3.azl3.x86_64.rpm
3434
bash-lang-5.2.15-3.azl3.x86_64.rpm
35-
binutils-2.41-6.azl3.x86_64.rpm
36-
binutils-aarch64-linux-gnu-2.41-6.azl3.x86_64.rpm
37-
binutils-debuginfo-2.41-6.azl3.x86_64.rpm
38-
binutils-devel-2.41-6.azl3.x86_64.rpm
35+
binutils-2.41-7.azl3.x86_64.rpm
36+
binutils-aarch64-linux-gnu-2.41-7.azl3.x86_64.rpm
37+
binutils-debuginfo-2.41-7.azl3.x86_64.rpm
38+
binutils-devel-2.41-7.azl3.x86_64.rpm
3939
bison-3.8.2-1.azl3.x86_64.rpm
4040
bison-debuginfo-3.8.2-1.azl3.x86_64.rpm
4141
bzip2-1.0.8-1.azl3.x86_64.rpm
@@ -70,7 +70,7 @@ cracklib-lang-2.9.11-1.azl3.x86_64.rpm
7070
createrepo_c-1.0.3-1.azl3.x86_64.rpm
7171
createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm
7272
createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm
73-
cross-binutils-common-2.41-6.azl3.noarch.rpm
73+
cross-binutils-common-2.41-7.azl3.noarch.rpm
7474
cross-gcc-common-13.2.0-7.azl3.noarch.rpm
7575
curl-8.11.1-3.azl3.x86_64.rpm
7676
curl-debuginfo-8.11.1-3.azl3.x86_64.rpm

0 commit comments

Comments
 (0)