Skip to content

Commit 5f65efc

Browse files
trungamsfrhuelsz
trungams
and
frhuelsz
authored
Signed-off-by: Thien Trung Vuong <tvuong@microsoft.com> Co-authored-by: Francisco Huelsz Prince <frhuelsz@microsoft.com>
1 parent febc095 commit 5f65efc

8 files changed

Lines changed: 75 additions & 13 deletions

File tree

‎SPECS/binutils/CVE-2022-35205.patch‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
2+
index 79bd2eeed42..409fd895688 100644
3+
--- a/binutils/dwarf.c
4+
+++ b/binutils/dwarf.c
5+
@@ -9782,7 +9782,12 @@ display_debug_names (struct dwarf_section *section, void *file)
6+
printf (_("Out of %lu items there are %zu bucket clashes"
7+
" (longest of %zu entries).\n"),
8+
(unsigned long) name_count, hash_clash_count, longest_clash);
9+
- assert (name_count == buckets_filled + hash_clash_count);
10+
+
11+
+ if (name_count != buckets_filled + hash_clash_count)
12+
+ warn (_("The name_count (%lu) is not the same as the used bucket_count (%lu) + the hash clash count (%lu)"),
13+
+ (unsigned long) name_count,
14+
+ (unsigned long) buckets_filled,
15+
+ (unsigned long) hash_clash_count);
16+
17+
struct abbrev_lookup_entry
18+
{

‎SPECS/binutils/CVE-2022-48063.patch‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
diff --git a/binutils/objdump.c b/binutils/objdump.c
2+
index a7b8303b992..1e2e83959bf 100644
3+
--- a/binutils/objdump.c
4+
+++ b/binutils/objdump.c
5+
@@ -3630,7 +3630,9 @@ load_specific_debug_section (enum dwarf_section_display_enum debug,
6+
section->size = bfd_section_size (sec);
7+
/* PR 24360: On 32-bit hosts sizeof (size_t) < sizeof (bfd_size_type). */
8+
alloced = amt = section->size + 1;
9+
- if (alloced != amt || alloced == 0)
10+
+ if (alloced != amt
11+
+ || alloced == 0
12+
+ || (bfd_get_size (abfd) != 0 && alloced >= bfd_get_size (abfd)))
13+
{
14+
section->start = NULL;
15+
free_debug_section (debug);

‎SPECS/binutils/CVE-2023-1972.patch‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
diff --git a/bfd/elf.c b/bfd/elf.c
2+
index eddc6304e1c..05bb9c99d5f 100644
3+
--- a/bfd/elf.c
4+
+++ b/bfd/elf.c
5+
@@ -8925,6 +8925,9 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
6+
bfd_set_error (bfd_error_file_too_big);
7+
goto error_return_verdef;
8+
}
9+
+
10+
+ if (amt == 0)
11+
+ goto error_return_verdef;
12+
elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
13+
if (elf_tdata (abfd)->verdef == NULL)
14+
goto error_return_verdef;
15+
@@ -9028,6 +9031,8 @@ _bfd_elf_slurp_version_tables (bfd *abfd, bool default_imported_symver)
16+
bfd_set_error (bfd_error_file_too_big);
17+
goto error_return;
18+
}
19+
+ if (amt == 0)
20+
+ goto error_return;
21+
elf_tdata (abfd)->verdef = (Elf_Internal_Verdef *) bfd_zalloc (abfd, amt);
22+
if (elf_tdata (abfd)->verdef == NULL)
23+
goto error_return;

‎SPECS/binutils/binutils.spec‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: Contains a linker, an assembler, and other tools
2222
Name: binutils
2323
Version: 2.37
24-
Release: 9%{?dist}
24+
Release: 10%{?dist}
2525
License: GPLv2+
2626
Vendor: Microsoft Corporation
2727
Distribution: Mariner
@@ -42,6 +42,9 @@ Patch7: CVE-2022-47007.patch
4242
Patch8: CVE-2022-47008.patch
4343
Patch9: CVE-2022-47010.patch
4444
Patch10: CVE-2022-47011.patch
45+
Patch11: CVE-2022-48063.patch
46+
Patch12: CVE-2023-1972.patch
47+
Patch13: CVE-2022-35205.patch
4548
Provides: bundled(libiberty)
4649

4750
# Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -298,6 +301,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
298301
%do_files aarch64-linux-gnu %{build_aarch64}
299302

300303
%changelog
304+
* Thu Nov 14 2024 Thien Trung Vuong <tvuong@microsoft.com> - 2.37-10
305+
- Added patch to fix CVE-2023-1972, CVE-2022-48063, CVE-2022-35205
306+
301307
* Mon Nov 04 2024 Nicolas Guibourge <nicolasg@microsoft.com> - 2.37-9
302308
- Address CVE-2022-47007, CVE-2022-47008, CVE-2022-47010, CVE-2022-47011.
303309

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.aarch64.rpm
1212
file-5.40-3.cm2.aarch64.rpm
1313
file-devel-5.40-3.cm2.aarch64.rpm
1414
file-libs-5.40-3.cm2.aarch64.rpm
15-
binutils-2.37-9.cm2.aarch64.rpm
16-
binutils-devel-2.37-9.cm2.aarch64.rpm
15+
binutils-2.37-10.cm2.aarch64.rpm
16+
binutils-devel-2.37-10.cm2.aarch64.rpm
1717
gmp-6.2.1-4.cm2.aarch64.rpm
1818
gmp-devel-6.2.1-4.cm2.aarch64.rpm
1919
mpfr-4.1.0-2.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.x86_64.rpm
1212
file-5.40-3.cm2.x86_64.rpm
1313
file-devel-5.40-3.cm2.x86_64.rpm
1414
file-libs-5.40-3.cm2.x86_64.rpm
15-
binutils-2.37-9.cm2.x86_64.rpm
16-
binutils-devel-2.37-9.cm2.x86_64.rpm
15+
binutils-2.37-10.cm2.x86_64.rpm
16+
binutils-devel-2.37-10.cm2.x86_64.rpm
1717
gmp-6.2.1-4.cm2.x86_64.rpm
1818
gmp-devel-6.2.1-4.cm2.x86_64.rpm
1919
mpfr-4.1.0-2.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ bash-5.1.8-4.cm2.aarch64.rpm
99
bash-debuginfo-5.1.8-4.cm2.aarch64.rpm
1010
bash-devel-5.1.8-4.cm2.aarch64.rpm
1111
bash-lang-5.1.8-4.cm2.aarch64.rpm
12-
binutils-2.37-9.cm2.aarch64.rpm
13-
binutils-debuginfo-2.37-9.cm2.aarch64.rpm
14-
binutils-devel-2.37-9.cm2.aarch64.rpm
12+
binutils-2.37-10.cm2.aarch64.rpm
13+
binutils-debuginfo-2.37-10.cm2.aarch64.rpm
14+
binutils-devel-2.37-10.cm2.aarch64.rpm
1515
bison-3.7.6-2.cm2.aarch64.rpm
1616
bison-debuginfo-3.7.6-2.cm2.aarch64.rpm
1717
bzip2-1.0.8-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ bash-5.1.8-4.cm2.x86_64.rpm
99
bash-debuginfo-5.1.8-4.cm2.x86_64.rpm
1010
bash-devel-5.1.8-4.cm2.x86_64.rpm
1111
bash-lang-5.1.8-4.cm2.x86_64.rpm
12-
binutils-2.37-9.cm2.x86_64.rpm
13-
binutils-aarch64-linux-gnu-2.37-9.cm2.x86_64.rpm
14-
binutils-debuginfo-2.37-9.cm2.x86_64.rpm
15-
binutils-devel-2.37-9.cm2.x86_64.rpm
12+
binutils-2.37-10.cm2.x86_64.rpm
13+
binutils-aarch64-linux-gnu-2.37-10.cm2.x86_64.rpm
14+
binutils-debuginfo-2.37-10.cm2.x86_64.rpm
15+
binutils-devel-2.37-10.cm2.x86_64.rpm
1616
bison-3.7.6-2.cm2.x86_64.rpm
1717
bison-debuginfo-3.7.6-2.cm2.x86_64.rpm
1818
bzip2-1.0.8-1.cm2.x86_64.rpm
@@ -47,7 +47,7 @@ cracklib-lang-2.9.7-5.cm2.x86_64.rpm
4747
createrepo_c-0.17.5-1.cm2.x86_64.rpm
4848
createrepo_c-debuginfo-0.17.5-1.cm2.x86_64.rpm
4949
createrepo_c-devel-0.17.5-1.cm2.x86_64.rpm
50-
cross-binutils-common-2.37-9.cm2.noarch.rpm
50+
cross-binutils-common-2.37-10.cm2.noarch.rpm
5151
cross-gcc-common-11.2.0-8.cm2.noarch.rpm
5252
curl-8.8.0-3.cm2.x86_64.rpm
5353
curl-debuginfo-8.8.0-3.cm2.x86_64.rpm

0 commit comments

Comments
 (0)