Skip to content

Commit c95b194

Browse files
committed
Patch gdb to fix CVE-2022-48064 and CVE-2022-48065 [Medium] (#13261)
(cherry picked from commit e749bf4)
1 parent 26616a9 commit c95b194

3 files changed

Lines changed: 158 additions & 1 deletion

File tree

SPECS/gdb/CVE-2022-48064.patch

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
From 8f2c64de86bc3d7556121fe296dd679000283931 Mon Sep 17 00:00:00 2001
2+
From: Alan Modra <amodra@gmail.com>
3+
Date: Tue, 20 Dec 2022 23:47:03 +1030
4+
Subject: [PATCH] PR29922, SHT_NOBITS section avoids section size sanity check
5+
6+
PR 29922
7+
* dwarf2.c (find_debug_info): Ignore sections without
8+
SEC_HAS_CONTENTS.
9+
---
10+
bfd/dwarf2.c | 12 +++++++++---
11+
1 file changed, 9 insertions(+), 3 deletions(-)
12+
13+
diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
14+
index 95f45708e9d..0cd8152ee6e 100644
15+
--- a/bfd/dwarf2.c
16+
+++ b/bfd/dwarf2.c
17+
@@ -4831,16 +4831,19 @@ find_debug_info (bfd *abfd, const struct dwarf_debug_section *debug_sections,
18+
{
19+
look = debug_sections[debug_info].uncompressed_name;
20+
msec = bfd_get_section_by_name (abfd, look);
21+
- if (msec != NULL)
22+
+ /* Testing SEC_HAS_CONTENTS is an anti-fuzzer measure. Of
23+
+ course debug sections always have contents. */
24+
+ if (msec != NULL && (msec->flags & SEC_HAS_CONTENTS) != 0)
25+
return msec;
26+
27+
look = debug_sections[debug_info].compressed_name;
28+
msec = bfd_get_section_by_name (abfd, look);
29+
- if (msec != NULL)
30+
+ if (msec != NULL && (msec->flags & SEC_HAS_CONTENTS) != 0)
31+
return msec;
32+
33+
for (msec = abfd->sections; msec != NULL; msec = msec->next)
34+
- if (startswith (msec->name, GNU_LINKONCE_INFO))
35+
+ if ((msec->flags & SEC_HAS_CONTENTS) != 0
36+
+ && startswith (msec->name, GNU_LINKONCE_INFO))
37+
return msec;
38+
39+
return NULL;
40+
@@ -4848,6 +4851,9 @@ find_debug_info (bfd *abfd, const struct dwarf_debug_section *debug_sections,
41+
42+
for (msec = after_sec->next; msec != NULL; msec = msec->next)
43+
{
44+
+ if ((msec->flags & SEC_HAS_CONTENTS) == 0)
45+
+ continue;
46+
+
47+
look = debug_sections[debug_info].uncompressed_name;
48+
if (strcmp (msec->name, look) == 0)
49+
return msec;
50+
--
51+
2.43.5

SPECS/gdb/CVE-2022-48065.patch

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
From 4dbabcbb6bb82fc71ee411d6a8b81918d775a0b5 Mon Sep 17 00:00:00 2001
2+
From: Alan Modra <amodra@gmail.com>
3+
Date: Wed, 21 Dec 2022 21:40:12 +1030
4+
Subject: [PATCH] PR29925, Memory leak in find_abstract_instance
5+
6+
The testcase in the PR had a variable with both DW_AT_decl_file and
7+
DW_AT_specification, where the DW_AT_specification also specified
8+
DW_AT_decl_file. This leads to a memory leak as the file name is
9+
malloced and duplicates are not expected.
10+
11+
I've also changed find_abstract_instance to not use a temp for "name",
12+
because that can result in a change in behaviour from the usual last
13+
of duplicate attributes wins.
14+
15+
PR 29925
16+
* dwarf2.c (find_abstract_instance): Delete "name" variable.
17+
Free *filename_ptr before assigning new file name.
18+
(scan_unit_for_symbols): Similarly free func->file and
19+
var->file before assigning.
20+
21+
Modified patch <d28fbc7197ba0e021a43f873eff90b05dcdcff6a> to apply to AzureLinux: Added required free statements based on code.
22+
Modified-by: Sandeep Karambelkar <skarambelkar@microsoft.com>
23+
---
24+
bfd/dwarf2.c | 13 +++++++------
25+
1 file changed, 7 insertions(+), 6 deletions(-)
26+
27+
diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
28+
index 83ca8a3..414c2d2 100644
29+
--- a/bfd/dwarf2.c
30+
+++ b/bfd/dwarf2.c
31+
@@ -2873,7 +2873,6 @@ find_abstract_instance (struct comp_unit *unit,
32+
struct abbrev_info *abbrev;
33+
bfd_uint64_t die_ref = attr_ptr->u.val;
34+
struct attribute attr;
35+
- const char *name = NULL;
36+
37+
if (recur_count == 100)
38+
{
39+
@@ -3038,16 +3037,16 @@ find_abstract_instance (struct comp_unit *unit,
40+
case DW_AT_name:
41+
/* Prefer DW_AT_MIPS_linkage_name or DW_AT_linkage_name
42+
over DW_AT_name. */
43+
- if (name == NULL && is_str_attr (attr.form))
44+
+ if (*pname == NULL && is_str_attr (attr.form))
45+
{
46+
- name = attr.u.str;
47+
+ *pname = attr.u.str;
48+
if (non_mangled (unit->lang))
49+
*is_linkage = true;
50+
}
51+
break;
52+
case DW_AT_specification:
53+
if (!find_abstract_instance (unit, &attr, recur_count + 1,
54+
- &name, is_linkage,
55+
+ pname, is_linkage,
56+
filename_ptr, linenumber_ptr))
57+
return false;
58+
break;
59+
@@ -3057,13 +3056,14 @@ find_abstract_instance (struct comp_unit *unit,
60+
non-string forms into these attributes. */
61+
if (is_str_attr (attr.form))
62+
{
63+
- name = attr.u.str;
64+
+ *pname = attr.u.str;
65+
*is_linkage = true;
66+
}
67+
break;
68+
case DW_AT_decl_file:
69+
if (!comp_unit_maybe_decode_line_info (unit))
70+
return false;
71+
+ free (*filename_ptr);
72+
*filename_ptr = concat_filename (unit->line_table,
73+
attr.u.val);
74+
break;
75+
@@ -3076,7 +3076,6 @@ find_abstract_instance (struct comp_unit *unit,
76+
}
77+
}
78+
}
79+
- *pname = name;
80+
return true;
81+
}
82+
83+
@@ -3510,6 +3509,7 @@ scan_unit_for_symbols (struct comp_unit *unit)
84+
break;
85+
86+
case DW_AT_decl_file:
87+
+ free (func->file);
88+
func->file = concat_filename (unit->line_table,
89+
attr.u.val);
90+
break;
91+
@@ -3559,6 +3559,7 @@ scan_unit_for_symbols (struct comp_unit *unit)
92+
break;
93+
94+
case DW_AT_decl_file:
95+
+ free (var->file);
96+
var->file = concat_filename (unit->line_table,
97+
attr.u.val);
98+
break;
99+
--
100+
2.45.2
101+

SPECS/gdb/gdb.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: C debugger
22
Name: gdb
33
Version: 11.2
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: GPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -13,6 +13,8 @@ Patch1: CVE-2023-39129.patch
1313
Patch2: CVE-2023-39130.patch
1414
Patch3: CVE-2025-1176.patch
1515
Patch4: CVE-2025-1182.patch
16+
Patch5: CVE-2022-48064.patch
17+
Patch6: CVE-2022-48065.patch
1618
BuildRequires: expat-devel
1719
BuildRequires: gcc-c++
1820
BuildRequires: gcc-gfortran
@@ -93,6 +95,9 @@ rm -f $(dirname $(gcc -print-libgcc-file-name))/../specs
9395
%{_mandir}/*/*
9496

9597
%changelog
98+
* Thu Apr 03 2025 Sandeep Karambelkar <skarambelkar@microsoft.com> - 11.2-5
99+
- Fix CVE-2022-48064, CVE-2022-48065
100+
96101
* Thu Feb 13 2025 Ankita Pareek <ankitapareek@microsoft.com> - 11.2-4
97102
- Address CVE-2025-1176 and CVE-2025-1182
98103

0 commit comments

Comments
 (0)