[AutoPR- Security] Patch gdb for CVE-2025-11414, CVE-2025-11412 [MEDIUM]

SPECS/gdb/CVE-2025-11412.patch

@@ -0,0 +1,37 @@
+From 7eb9f66264433f2fc78d6b8d42a246886b017901 Mon Sep 17 00:00:00 2001
+From: Alan Modra <[email protected]>
+Date: Thu, 25 Sep 2025 08:22:24 +0930
+Subject: [PATCH] PR 33452 SEGV in bfd_elf_gc_record_vtentry
+
+Limit addends on vtentry relocs, otherwise ld might attempt to
+allocate a stupidly large array.  This also fixes the expression
+overflow leading to pr33452.  A vtable of 33M entries on a 64-bit
+host is surely large enough, especially considering that VTINHERIT
+and VTENTRY relocations are to support -fvtable-gc that disappeared
+from gcc over 20 years ago.
+
+	PR ld/33452
+	* elflink.c (bfd_elf_gc_record_vtentry): Sanity check addend.
+
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: https://github.com/bminor/binutils-gdb/commit/047435dd988a3975d40c6626a8f739a0b2e154bc.patch
+---
+ bfd/elflink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/bfd/elflink.c b/bfd/elflink.c
+index b22fd11..dc0267e 100644
+--- a/bfd/elflink.c
++++ b/bfd/elflink.c
+@@ -14204,7 +14204,7 @@ bfd_elf_gc_record_vtentry (bfd *abfd, asection *sec,
+   const struct elf_backend_data *bed = get_elf_backend_data (abfd);
+   unsigned int log_file_align = bed->s->log_file_align;
+
+-  if (!h)
++  if (!h || addend > 1u << 28)
+     {
+       /* xgettext:c-format */
+       _bfd_error_handler (_("%pB: section '%pA': corrupt VTENTRY entry"),
+-- 
+2.45.4
+

SPECS/gdb/CVE-2025-11414.patch

@@ -0,0 +1,79 @@
+From 28ca8efad8004129ef450a67394a88395f189ede Mon Sep 17 00:00:00 2001
+From: AllSpark <[email protected]>
+Date: Thu, 16 Oct 2025 14:34:44 +0000
+Subject: [PATCH] elf: Return error on unsorted symbol table if not allowed
+
+Normally ELF symbol table should be sorted, i.e., local symbols precede
+global symbols. Irix 6 is an exception and its elf_bad_symtab is set
+to true. Issue an error if elf_bad_symtab is false and symbol table is
+unsorted.
+
+PR ld/33450
+* elflink.c (set_symbol_value): Change return type to bool and
+return false on error. Issue an error on unsorted symbol table
+if not allowed.
+(elf_link_input_bfd): Return false if set_symbol_value reurns
+false.
+
+Signed-off-by: H.J. Lu <[email protected]>
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: AI Backport of https://github.com/bminor/binutils-gdb/commit/aeaaa9af6359c8e394ce9cf24911fec4f4d23703.patch
+---
+ bfd/elflink.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/bfd/elflink.c b/bfd/elflink.c
+index dc0267e..1a1a44e 100644
+--- a/bfd/elflink.c
++++ b/bfd/elflink.c
+@@ -8596,7 +8596,7 @@ struct elf_outext_info
+    <binary-operator> := as in C
+    <unary-operator> := as in C, plus "0-" for unambiguous negation.  */
+
+-static void
++static bool
+ set_symbol_value (bfd *bfd_with_globals,
+ 		  Elf_Internal_Sym *isymbuf,
+ 		  size_t locsymcount,
+@@ -8618,9 +8618,15 @@ set_symbol_value (bfd *bfd_with_globals,
+ 	     "absolute" section and give it a value.  */
+ 	  sym->st_shndx = SHN_ABS;
+ 	  sym->st_value = val;
+-	  return;
++	  return true;
++	}
++      if (!elf_bad_symtab (bfd_with_globals))
++	{
++	  _bfd_error_handler (_("%pB: corrupt symbol table"),
++			      bfd_with_globals);
++	  bfd_set_error (bfd_error_bad_value);
++	  return false;
+ 	}
+-      BFD_ASSERT (elf_bad_symtab (bfd_with_globals));
+       extsymoff = 0;
+     }
+
+@@ -8635,6 +8641,7 @@ set_symbol_value (bfd *bfd_with_globals,
+   h->root.type = bfd_link_hash_defined;
+   h->root.u.def.value = val;
+   h->root.u.def.section = bfd_abs_section_ptr;
++  return true;
+ }
+
+ static bool
+@@ -11338,8 +11345,10 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd)
+ 		    return false;
+
+ 		  /* Symbol evaluated OK.  Update to absolute value.  */
+-		  set_symbol_value (input_bfd, isymbuf, locsymcount,
+-				    r_symndx, val);
++		  if (!set_symbol_value (input_bfd, isymbuf, locsymcount, r_symndx,
++					 val))
++		    return false;
++
+ 		  continue;
+ 		}
+
+-- 
+2.45.4
+

SPECS/gdb/gdb.spec

@@ -1,7 +1,7 @@
 Summary:        C debugger
 Name:           gdb
 Version:        11.2
-Release:        7%{?dist}
+Release:        8%{?dist}
 License:        GPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -18,6 +18,8 @@ Patch6:         CVE-2022-48065.patch
 Patch7:         CVE-2022-47673.patch
 Patch8:         CVE-2022-47696.patch
 Patch9:         CVE-2025-7546.patch
+Patch10:        CVE-2025-11412.patch
+Patch11:        CVE-2025-11414.patch
 BuildRequires:  expat-devel
 BuildRequires:  gcc-c++
 BuildRequires:  gcc-gfortran
@@ -102,6 +104,9 @@ rm -rvf libctf/testsuite
 %{_mandir}/*/*
 
 %changelog
+* Thu Oct 16 2025 Azure Linux Security Servicing Account <[email protected]> - 11.2-8
+- Patch for CVE-2025-11414, CVE-2025-11412
+
 * Fri Jul 18 2025 Akhila Guruju <[email protected]> - 11.2-7
 - Patch CVE-2025-7546
 - Fix package tests