diff --git a/SPECS/gdb/CVE-2025-11412.patch b/SPECS/gdb/CVE-2025-11412.patch new file mode 100644 index 00000000000..f896303d597 --- /dev/null +++ b/SPECS/gdb/CVE-2025-11412.patch @@ -0,0 +1,37 @@ +From 7eb9f66264433f2fc78d6b8d42a246886b017901 Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Thu, 25 Sep 2025 08:22:24 +0930 +Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry + +Limit addends on vtentry relocs, otherwise ld might attempt to +allocate a stupidly large array. This also fixes the expression +overflow leading to pr33452. A vtable of 33M entries on a 64-bit +host is surely large enough, especially considering that VTINHERIT +and VTENTRY relocations are to support -fvtable-gc that disappeared +from gcc over 20 years ago. + + PR ld/33452 + * elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/bminor/binutils-gdb/commit/047435dd988a3975d40c6626a8f739a0b2e154bc.patch +--- + bfd/elflink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bfd/elflink.c b/bfd/elflink.c +index b22fd11..dc0267e 100644 +--- a/bfd/elflink.c ++++ b/bfd/elflink.c +@@ -14204,7 +14204,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec, + const struct elf_backend_data *bed = get_elf_backend_data (abfd); + unsigned int log_file_align = bed->s->log_file_align; + +- if (!h) ++ if (!h || addend > 1u << 28) + { + /* xgettext:c-format */ + _bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"), +-- +2.45.4 + diff --git a/SPECS/gdb/CVE-2025-11414.patch b/SPECS/gdb/CVE-2025-11414.patch new file mode 100644 index 00000000000..913517018c2 --- /dev/null +++ b/SPECS/gdb/CVE-2025-11414.patch @@ -0,0 +1,79 @@ +From 28ca8efad8004129ef450a67394a88395f189ede Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Thu, 16 Oct 2025 14:34:44 +0000 +Subject: [PATCH] elf: Return error on unsorted symbol table if not allowed + +Normally ELF symbol table should be sorted, i.e., local symbols precede +global symbols. Irix 6 is an exception and its elf_bad_symtab is set +to true. Issue an error if elf_bad_symtab is false and symbol table is +unsorted. + +PR ld/33450 +* elflink.c (set_symbol_value): Change return type to bool and +return false on error. Issue an error on unsorted symbol table +if not allowed. +(elf_link_input_bfd): Return false if set_symbol_value reurns +false. + +Signed-off-by: H.J. Lu +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/bminor/binutils-gdb/commit/aeaaa9af6359c8e394ce9cf24911fec4f4d23703.patch +--- + bfd/elflink.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/bfd/elflink.c b/bfd/elflink.c +index dc0267e..1a1a44e 100644 +--- a/bfd/elflink.c ++++ b/bfd/elflink.c +@@ -8596,7 +8596,7 @@ struct elf_outext_info + := as in C + := as in C, plus "0-" for unambiguous negation. */ + +-static void ++static bool + set_symbol_value (bfd *bfd_with_globals, + Elf_Internal_Sym *isymbuf, + size_t locsymcount, +@@ -8618,9 +8618,15 @@ set_symbol_value (bfd *bfd_with_globals, + "absolute" section and give it a value. */ + sym->st_shndx = SHN_ABS; + sym->st_value = val; +- return; ++ return true; ++ } ++ if (!elf_bad_symtab (bfd_with_globals)) ++ { ++ _bfd_error_handler (_("%pB: corrupt symbol table"), ++ bfd_with_globals); ++ bfd_set_error (bfd_error_bad_value); ++ return false; + } +- BFD_ASSERT (elf_bad_symtab (bfd_with_globals)); + extsymoff = 0; + } + +@@ -8635,6 +8641,7 @@ set_symbol_value (bfd *bfd_with_globals, + h->root.type = bfd_link_hash_defined; + h->root.u.def.value = val; + h->root.u.def.section = bfd_abs_section_ptr; ++ return true; + } + + static bool +@@ -11338,8 +11345,10 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd) + return false; + + /* Symbol evaluated OK. Update to absolute value. */ +- set_symbol_value (input_bfd, isymbuf, locsymcount, +- r_symndx, val); ++ if (!set_symbol_value (input_bfd, isymbuf, locsymcount, r_symndx, ++ val)) ++ return false; ++ + continue; + } + +-- +2.45.4 + diff --git a/SPECS/gdb/gdb.spec b/SPECS/gdb/gdb.spec index bc2085e58b4..948455d419e 100644 --- a/SPECS/gdb/gdb.spec +++ b/SPECS/gdb/gdb.spec @@ -1,7 +1,7 @@ Summary: C debugger Name: gdb Version: 11.2 -Release: 7%{?dist} +Release: 8%{?dist} License: GPLv2+ Vendor: Microsoft Corporation Distribution: Mariner @@ -18,6 +18,8 @@ Patch6: CVE-2022-48065.patch Patch7: CVE-2022-47673.patch Patch8: CVE-2022-47696.patch Patch9: CVE-2025-7546.patch +Patch10: CVE-2025-11412.patch +Patch11: CVE-2025-11414.patch BuildRequires: expat-devel BuildRequires: gcc-c++ BuildRequires: gcc-gfortran @@ -102,6 +104,9 @@ rm -rvf libctf/testsuite %{_mandir}/*/* %changelog +* Thu Oct 16 2025 Azure Linux Security Servicing Account - 11.2-8 +- Patch for CVE-2025-11414, CVE-2025-11412 + * Fri Jul 18 2025 Akhila Guruju - 11.2-7 - Patch CVE-2025-7546 - Fix package tests