Skip to content

Commit 117f635

Browse files
CBL-Mariner-BotAnkita13-code
CBL-Mariner-Bot
and
Ankita13-code
authored
[AUTO-CHERRYPICK] gdb: Address CVE-2025-1176 and CVE-2025-1182 [Medium] - branch main (#12959)
Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>
1 parent 087cfc7 commit 117f635

3 files changed

Lines changed: 193 additions & 1 deletion

File tree

‎SPECS/gdb/CVE-2025-1176.patch‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
From 6741ce18a0eb447842a9d8065d32077581ecc78a Mon Sep 17 00:00:00 2001
2+
From: Nick Clifton <nickc@redhat.com>
3+
Date: Wed, 5 Feb 2025 11:15:11 +0000
4+
Subject: [PATCH] Prevent illegal memory access when indexing into the
5+
sym_hashes array of the elf bfd cookie structure.
6+
7+
PR 32636
8+
9+
Source: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814
10+
---
11+
bfd/elflink.c | 90 +++++++++++++++++++++++++--------------------------
12+
1 file changed, 45 insertions(+), 45 deletions(-)
13+
14+
diff --git a/bfd/elflink.c b/bfd/elflink.c
15+
index 9a05208..9acfe8b 100644
16+
--- a/bfd/elflink.c
17+
+++ b/bfd/elflink.c
18+
@@ -62,22 +62,37 @@ struct elf_find_verdep_info
19+
static bool _bfd_elf_fix_symbol_flags
20+
(struct elf_link_hash_entry *, struct elf_info_failed *);
21+
22+
-asection *
23+
-_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
24+
- unsigned long r_symndx,
25+
- bool discard)
26+
+static struct elf_link_hash_entry *
27+
+get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
28+
{
29+
- if (r_symndx >= cookie->locsymcount
30+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
31+
- {
32+
- struct elf_link_hash_entry *h;
33+
+ struct elf_link_hash_entry *h = NULL;
34+
35+
+ if ((r_symndx >= cookie->locsymcount
36+
+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
37+
+ /* Guard against corrupt input. See PR 32636 for an example. */
38+
+ && r_symndx >= cookie->extsymoff)
39+
+ {
40+
h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
41+
42+
while (h->root.type == bfd_link_hash_indirect
43+
|| h->root.type == bfd_link_hash_warning)
44+
h = (struct elf_link_hash_entry *) h->root.u.i.link;
45+
+ }
46+
+
47+
+ return h;
48+
+}
49+
50+
+asection *
51+
+_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
52+
+ unsigned long r_symndx,
53+
+ bool discard)
54+
+{
55+
+ struct elf_link_hash_entry *h;
56+
+
57+
+ h = get_ext_sym_hash (cookie, r_symndx);
58+
+
59+
+ if (h != NULL)
60+
+ {
61+
if ((h->root.type == bfd_link_hash_defined
62+
|| h->root.type == bfd_link_hash_defweak)
63+
&& discarded_section (h->root.u.def.section))
64+
@@ -85,21 +100,20 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
65+
else
66+
return NULL;
67+
}
68+
- else
69+
- {
70+
- /* It's not a relocation against a global symbol,
71+
- but it could be a relocation against a local
72+
- symbol for a discarded section. */
73+
- asection *isec;
74+
- Elf_Internal_Sym *isym;
75+
76+
- /* Need to: get the symbol; get the section. */
77+
- isym = &cookie->locsyms[r_symndx];
78+
- isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
79+
- if (isec != NULL
80+
- && discard ? discarded_section (isec) : 1)
81+
- return isec;
82+
- }
83+
+ /* It's not a relocation against a global symbol,
84+
+ but it could be a relocation against a local
85+
+ symbol for a discarded section. */
86+
+ asection *isec;
87+
+ Elf_Internal_Sym *isym;
88+
+
89+
+ /* Need to: get the symbol; get the section. */
90+
+ isym = &cookie->locsyms[r_symndx];
91+
+ isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
92+
+ if (isec != NULL
93+
+ && discard ? discarded_section (isec) : 1)
94+
+ return isec;
95+
+
96+
return NULL;
97+
}
98+
99+
@@ -13442,22 +13456,12 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
100+
if (r_symndx == STN_UNDEF)
101+
return NULL;
102+
103+
- if (r_symndx >= cookie->locsymcount
104+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
105+
+ h = get_ext_sym_hash (cookie, r_symndx);
106+
+
107+
+ if (h != NULL)
108+
{
109+
bool was_marked;
110+
111+
- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
112+
- if (h == NULL)
113+
- {
114+
- info->callbacks->einfo (_("%F%P: corrupt input: %pB\n"),
115+
- sec->owner);
116+
- return NULL;
117+
- }
118+
- while (h->root.type == bfd_link_hash_indirect
119+
- || h->root.type == bfd_link_hash_warning)
120+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
121+
-
122+
was_marked = h->mark;
123+
h->mark = 1;
124+
/* Keep all aliases of the symbol too. If an object symbol
125+
@@ -14491,17 +14495,12 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
126+
if (r_symndx == STN_UNDEF)
127+
return true;
128+
129+
- if (r_symndx >= rcookie->locsymcount
130+
- || ELF_ST_BIND (rcookie->locsyms[r_symndx].st_info) != STB_LOCAL)
131+
- {
132+
- struct elf_link_hash_entry *h;
133+
-
134+
- h = rcookie->sym_hashes[r_symndx - rcookie->extsymoff];
135+
-
136+
- while (h->root.type == bfd_link_hash_indirect
137+
- || h->root.type == bfd_link_hash_warning)
138+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
139+
+ struct elf_link_hash_entry *h;
140+
141+
+ h = get_ext_sym_hash (rcookie, r_symndx);
142+
+
143+
+ if (h != NULL)
144+
+ {
145+
if ((h->root.type == bfd_link_hash_defined
146+
|| h->root.type == bfd_link_hash_defweak)
147+
&& (h->root.u.def.section->owner != rcookie->abfd
148+
@@ -14525,6 +14524,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
149+
|| discarded_section (isec)))
150+
return true;
151+
}
152+
+
153+
return false;
154+
}
155+
return false;
156+
--
157+
2.34.1
158+

‎SPECS/gdb/CVE-2025-1182.patch‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
From 296798f53ea8085bcd6ee168a57c8df0c8a1a0ef Mon Sep 17 00:00:00 2001
2+
From: Ankita Pareek <ankitapareek@microsoft.com>
3+
Date: Wed, 19 Feb 2025 15:43:58 +0530
4+
Subject: [PATCH] gdb: Add patch for CVE-2025-1182 Upstream fix:
5+
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b425859021d17adf62f06fb904797cf8642986ad
6+
7+
Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
8+
---
9+
bfd/elflink.c | 4 ++++
10+
1 file changed, 4 insertions(+)
11+
12+
diff --git a/bfd/elflink.c b/bfd/elflink.c
13+
index 9acfe8b..b22fd11 100644
14+
--- a/bfd/elflink.c
15+
+++ b/bfd/elflink.c
16+
@@ -14510,6 +14510,10 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
17+
}
18+
else
19+
{
20+
+ if (r_symndx >= rcookie->locsymcount)
21+
+ /* This can happen with corrupt input. */
22+
+ return false;
23+
+
24+
/* It's not a relocation against a global symbol,
25+
but it could be a relocation against a local
26+
symbol for a discarded section. */
27+
--
28+
2.34.1
29+

‎SPECS/gdb/gdb.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: C debugger
22
Name: gdb
33
Version: 11.2
4-
Release: 3%{?dist}
4+
Release: 4%{?dist}
55
License: GPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -11,6 +11,8 @@ Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
1111
Patch0: CVE-2023-39128.patch
1212
Patch1: CVE-2023-39129.patch
1313
Patch2: CVE-2023-39130.patch
14+
Patch3: CVE-2025-1176.patch
15+
Patch4: CVE-2025-1182.patch
1416
BuildRequires: expat-devel
1517
BuildRequires: gcc-c++
1618
BuildRequires: gcc-gfortran
@@ -91,6 +93,9 @@ rm -f $(dirname $(gcc -print-libgcc-file-name))/../specs
9193
%{_mandir}/*/*
9294

9395
%changelog
96+
* Thu Feb 13 2025 Ankita Pareek <ankitapareek@microsoft.com> - 11.2-4
97+
- Address CVE-2025-1176 and CVE-2025-1182
98+
9499
* Tue Oct 08 2024 Mitch Zhu <mitchzhu@microsoft.com> - 11.2-3
95100
- Fix CVE-2023-39128, CVE-2023-39129, CVE-2023-39130
96101

0 commit comments

Comments
 (0)