Skip to content

Commit c8c411f

Browse files
[AutoPR- Security] Patch binutils for CVE-2025-11083, CVE-2025-11082 [MEDIUM] (#14764)
Co-authored-by: jykanase <v-jykanase@microsoft.com>
1 parent b4cf5ac commit c8c411f

7 files changed

Lines changed: 139 additions & 13 deletions

File tree

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From ab0cbd03355bfa778beb3f8484f55c975f1066c8 Mon Sep 17 00:00:00 2001
2+
From: "H.J. Lu" <hjl.tools@gmail.com>
3+
Date: Mon, 22 Sep 2025 15:20:34 +0800
4+
Subject: [PATCH] elf: Don't read beyond .eh_frame section size
5+
6+
PR ld/33464
7+
* elf-eh-frame.c (_bfd_elf_parse_eh_frame): Don't read beyond
8+
.eh_frame section size.
9+
10+
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
11+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
12+
Upstream-reference: https://github.com/bminor/binutils-gdb/commit/ea1a0737c7692737a644af0486b71e4a392cbca8.patch
13+
---
14+
bfd/elf-eh-frame.c | 8 ++++++--
15+
1 file changed, 6 insertions(+), 2 deletions(-)
16+
17+
diff --git a/bfd/elf-eh-frame.c b/binutils-2.41/bfd/elf-eh-frame.c
18+
index bf7a9902..7d11a9ed 100644
19+
--- a/bfd/elf-eh-frame.c
20+
+++ b/bfd/elf-eh-frame.c
21+
@@ -734,6 +734,7 @@ _bfd_elf_parse_eh_frame (bfd *abfd, struct bfd_link_info *info,
22+
if (hdr_id == 0)
23+
{
24+
unsigned int initial_insn_length;
25+
+ char *null_byte;
26+
27+
/* CIE */
28+
this_inf->cie = 1;
29+
@@ -750,10 +751,13 @@ _bfd_elf_parse_eh_frame (bfd *abfd, struct bfd_link_info *info,
30+
REQUIRE (cie->version == 1
31+
|| cie->version == 3
32+
|| cie->version == 4);
33+
- REQUIRE (strlen ((char *) buf) < sizeof (cie->augmentation));
34+
+ null_byte = memchr ((char *) buf, 0, end - buf);
35+
+ REQUIRE (null_byte != NULL);
36+
+ REQUIRE ((size_t) (null_byte - (char *) buf)
37+
+ < sizeof (cie->augmentation));
38+
39+
strcpy (cie->augmentation, (char *) buf);
40+
- buf = (bfd_byte *) strchr ((char *) buf, '\0') + 1;
41+
+ buf = (bfd_byte *) null_byte + 1;
42+
this_inf->u.cie.aug_str_len = buf - start - 1;
43+
ENSURE_NO_RELOCS (buf);
44+
if (buf[0] == 'e' && buf[1] == 'h')
45+
--
46+
2.45.4
47+
Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
From b598030bd2734ab9e5774b0c30eafc5a1a3bf7b5 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Wed, 1 Oct 2025 19:03:19 +0000
4+
Subject: [PATCH] elf: Don't match corrupt section header in linker input (PR
5+
ld/33457)
6+
7+
- Change elf_swap_shdr_in to return bool and return false for corrupt section headers in linker input.
8+
- Update elf_object_p to reject if elf_swap_shdr_in returns false.
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
11+
Upstream-reference: AI Backport of https://github.com/bminor/binutils-gdb/commit/9ca499644a21ceb3f946d1c179c38a83be084490.patch
12+
---
13+
bfd/elfcode.h | 15 ++++++++++-----
14+
1 file changed, 10 insertions(+), 5 deletions(-)
15+
16+
diff --git a/binutils-2.41/bfd/elfcode.h b/binutils-2.41/bfd/elfcode.h
17+
index b2277921..67cf445c 100644
18+
--- a/bfd/elfcode.h
19+
+++ b/bfd/elfcode.h
20+
@@ -311,7 +311,7 @@ elf_swap_ehdr_out (bfd *abfd,
21+
/* Translate an ELF section header table entry in external format into an
22+
ELF section header table entry in internal format. */
23+
24+
-static void
25+
+static bool
26+
elf_swap_shdr_in (bfd *abfd,
27+
const Elf_External_Shdr *src,
28+
Elf_Internal_Shdr *dst)
29+
@@ -341,6 +341,9 @@ elf_swap_shdr_in (bfd *abfd,
30+
{
31+
_bfd_error_handler (_("warning: %pB has a section "
32+
"extending past end of file"), abfd);
33+
+ /* PR ld/33457: Don't match corrupt section header. */
34+
+ if (abfd->is_linker_input)
35+
+ return false;
36+
abfd->read_only = 1;
37+
}
38+
}
39+
@@ -350,6 +353,8 @@ elf_swap_shdr_in (bfd *abfd,
40+
dst->sh_entsize = H_GET_WORD (abfd, src->sh_entsize);
41+
dst->bfd_section = NULL;
42+
dst->contents = NULL;
43+
+ return true;
44+
+
45+
}
46+
47+
/* Translate an ELF section header table entry in internal format into an
48+
@@ -642,9 +647,9 @@ elf_object_p (bfd *abfd)
49+
50+
/* Read the first section header at index 0, and convert to internal
51+
form. */
52+
- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
53+
+ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
54+
+ || !elf_swap_shdr_in (abfd, &x_shdr, &i_shdr))
55+
goto got_no_match;
56+
- elf_swap_shdr_in (abfd, &x_shdr, &i_shdr);
57+
58+
/* If the section count is zero, the actual count is in the first
59+
section header. */
60+
@@ -730,9 +735,9 @@ elf_object_p (bfd *abfd)
61+
to internal form. */
62+
for (shindex = 1; shindex < i_ehdrp->e_shnum; shindex++)
63+
{
64+
- if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr))
65+
+ if (bfd_bread (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)
66+
+ || !elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex))
67+
goto got_no_match;
68+
- elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex);
69+
70+
/* Sanity check sh_link and sh_info. */
71+
if (i_shdrp[shindex].sh_link >= num_sec)
72+
--
73+
2.45.4
74+

SPECS/binutils/binutils.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: Contains a linker, an assembler, and other tools
2222
Name: binutils
2323
Version: 2.41
24-
Release: 8%{?dist}
24+
Release: 9%{?dist}
2525
License: GPLv2+
2626
Vendor: Microsoft Corporation
2727
Distribution: Azure Linux
@@ -43,6 +43,8 @@ Patch9: CVE-2025-5244.patch
4343
Patch10: CVE-2025-7546.patch
4444
Patch11: CVE-2025-7545.patch
4545
Patch12: CVE-2025-8225.patch
46+
Patch13: CVE-2025-11082.patch
47+
Patch14: CVE-2025-11083.patch
4648
Provides: bundled(libiberty)
4749

4850
# Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -332,6 +334,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
332334
%do_files aarch64-linux-gnu %{build_aarch64}
333335

334336
%changelog
337+
* Wed Oct 01 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.41-9
338+
- Patch for CVE-2025-11083, CVE-2025-11082
339+
335340
* Mon Jul 28 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.41-8
336341
- Patch for CVE-2025-8225
337342

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.aarch64.rpm
1313
file-5.45-1.azl3.aarch64.rpm
1414
file-devel-5.45-1.azl3.aarch64.rpm
1515
file-libs-5.45-1.azl3.aarch64.rpm
16-
binutils-2.41-8.azl3.aarch64.rpm
17-
binutils-devel-2.41-8.azl3.aarch64.rpm
16+
binutils-2.41-9.azl3.aarch64.rpm
17+
binutils-devel-2.41-9.azl3.aarch64.rpm
1818
gmp-6.3.0-1.azl3.aarch64.rpm
1919
gmp-devel-6.3.0-1.azl3.aarch64.rpm
2020
mpfr-4.2.1-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ zlib-devel-1.3.1-1.azl3.x86_64.rpm
1313
file-5.45-1.azl3.x86_64.rpm
1414
file-devel-5.45-1.azl3.x86_64.rpm
1515
file-libs-5.45-1.azl3.x86_64.rpm
16-
binutils-2.41-8.azl3.x86_64.rpm
17-
binutils-devel-2.41-8.azl3.x86_64.rpm
16+
binutils-2.41-9.azl3.x86_64.rpm
17+
binutils-devel-2.41-9.azl3.x86_64.rpm
1818
gmp-6.3.0-1.azl3.x86_64.rpm
1919
gmp-devel-6.3.0-1.azl3.x86_64.rpm
2020
mpfr-4.2.1-1.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ bash-5.2.15-3.azl3.aarch64.rpm
3030
bash-debuginfo-5.2.15-3.azl3.aarch64.rpm
3131
bash-devel-5.2.15-3.azl3.aarch64.rpm
3232
bash-lang-5.2.15-3.azl3.aarch64.rpm
33-
binutils-2.41-8.azl3.aarch64.rpm
34-
binutils-debuginfo-2.41-8.azl3.aarch64.rpm
35-
binutils-devel-2.41-8.azl3.aarch64.rpm
33+
binutils-2.41-9.azl3.aarch64.rpm
34+
binutils-debuginfo-2.41-9.azl3.aarch64.rpm
35+
binutils-devel-2.41-9.azl3.aarch64.rpm
3636
bison-3.8.2-1.azl3.aarch64.rpm
3737
bison-debuginfo-3.8.2-1.azl3.aarch64.rpm
3838
bzip2-1.0.8-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ bash-5.2.15-3.azl3.x86_64.rpm
3232
bash-debuginfo-5.2.15-3.azl3.x86_64.rpm
3333
bash-devel-5.2.15-3.azl3.x86_64.rpm
3434
bash-lang-5.2.15-3.azl3.x86_64.rpm
35-
binutils-2.41-8.azl3.x86_64.rpm
36-
binutils-aarch64-linux-gnu-2.41-8.azl3.x86_64.rpm
37-
binutils-debuginfo-2.41-8.azl3.x86_64.rpm
38-
binutils-devel-2.41-8.azl3.x86_64.rpm
35+
binutils-2.41-9.azl3.x86_64.rpm
36+
binutils-aarch64-linux-gnu-2.41-9.azl3.x86_64.rpm
37+
binutils-debuginfo-2.41-9.azl3.x86_64.rpm
38+
binutils-devel-2.41-9.azl3.x86_64.rpm
3939
bison-3.8.2-1.azl3.x86_64.rpm
4040
bison-debuginfo-3.8.2-1.azl3.x86_64.rpm
4141
bzip2-1.0.8-1.azl3.x86_64.rpm
@@ -70,7 +70,7 @@ cracklib-lang-2.9.11-1.azl3.x86_64.rpm
7070
createrepo_c-1.0.3-1.azl3.x86_64.rpm
7171
createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm
7272
createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm
73-
cross-binutils-common-2.41-8.azl3.noarch.rpm
73+
cross-binutils-common-2.41-9.azl3.noarch.rpm
7474
cross-gcc-common-13.2.0-7.azl3.noarch.rpm
7575
curl-8.11.1-4.azl3.x86_64.rpm
7676
curl-debuginfo-8.11.1-4.azl3.x86_64.rpm

0 commit comments

Comments
 (0)