Skip to content

Commit e4614ca

Browse files
azurelinux-securityKanishk Bansal
azurelinux-security
and
Kanishk Bansal
authored
[AutoPR- Security] Patch binutils for CVE-2025-7545, CVE-2025-7546 [MEDIUM] (#14335)
Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com> Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
1 parent 61b7855 commit e4614ca

7 files changed

Lines changed: 101 additions & 13 deletions

File tree

‎SPECS/binutils/CVE-2025-7545.patch‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 5ea79aec8f03363778904754b75337f73be0db16 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<azurelinux-security@microsoft.com>
4+
Date: Thu, 17 Jul 2025 08:56:14 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-7545 in binutils
6+
7+
Upstream Patch Reference: https://github.com/bminor/binutils-gdb/commit/08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944.patch
8+
---
9+
binutils/objcopy.c | 6 ++++++
10+
1 file changed, 6 insertions(+)
11+
12+
diff --git a/binutils/objcopy.c b/binutils/objcopy.c
13+
index a6c2e0dc..b9552398 100644
14+
--- a/binutils/objcopy.c
15+
+++ b/binutils/objcopy.c
16+
@@ -4438,6 +4438,7 @@ copy_section (bfd *ibfd, sec_ptr isection, void *obfdarg)
17+
char *to = (char *) memhunk;
18+
char *end = (char *) memhunk + size;
19+
int i;
20+
+ bfd_size_type memhunk_size = size;
21+
22+
/* If the section address is not exactly divisible by the interleave,
23+
then we must bias the from address. If the copy_byte is less than
24+
@@ -4457,6 +4458,11 @@ copy_section (bfd *ibfd, sec_ptr isection, void *obfdarg)
25+
}
26+
27+
size = (size + interleave - 1 - copy_byte) / interleave * copy_width;
28+
+
29+
+ /* Don't extend the output section size. */
30+
+ if (size > memhunk_size)
31+
+ size = memhunk_size;
32+
+
33+
osection->lma /= interleave;
34+
if (copy_byte < extra)
35+
osection->lma++;
36+
--
37+
2.45.3
38+

‎SPECS/binutils/CVE-2025-7546.patch‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From 41461010eb7c79fee7a9d5f6209accdaac66cc6b Mon Sep 17 00:00:00 2001
2+
From: "H.J. Lu" <hjl.tools@gmail.com>
3+
Date: Sat, 21 Jun 2025 06:52:00 +0800
4+
Subject: [PATCH] elf: Report corrupted group section
5+
6+
Report corrupted group section instead of trying to recover.
7+
8+
PR binutils/33050
9+
* elf.c (bfd_elf_set_group_contents): Report corrupted group
10+
section.
11+
12+
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
13+
14+
[AI Backported] Upstream Patch Reference: https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b
15+
---
16+
bfd/elf.c | 12 +++++++++++-
17+
1 file changed, 11 insertions(+), 1 deletion(-)
18+
19+
diff --git a/bfd/elf.c b/bfd/elf.c
20+
index 05bb9c99..4fc0a65e 100644
21+
--- a/bfd/elf.c
22+
+++ b/bfd/elf.c
23+
@@ -3633,8 +3633,18 @@ bfd_elf_set_group_contents (bfd *abfd, asection *sec, void *failedptrarg)
24+
break;
25+
}
26+
27+
+ /* We should always get here with loc == sec->contents + 4. Return
28+
+ an error for bogus SHT_GROUP sections. */
29+
loc -= 4;
30+
- BFD_ASSERT (loc == sec->contents);
31+
+ if (loc != sec->contents)
32+
+ {
33+
+ /* xgettext:c-format */
34+
+ _bfd_error_handler (_("%pB: corrupted group section: `%pA'"),
35+
+ abfd, sec);
36+
+ bfd_set_error (bfd_error_bad_value);
37+
+ *failedptr = true;
38+
+ return;
39+
+ }
40+
41+
H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc);
42+
}
43+
--
44+
2.45.3
45+

‎SPECS/binutils/binutils.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: Contains a linker, an assembler, and other tools
2222
Name: binutils
2323
Version: 2.37
24-
Release: 15%{?dist}
24+
Release: 16%{?dist}
2525
License: GPLv2+
2626
Vendor: Microsoft Corporation
2727
Distribution: Mariner
@@ -53,6 +53,8 @@ Patch18: CVE-2025-1178.patch
5353
Patch19: CVE-2025-1744.patch
5454
Patch20: CVE-2025-5245.patch
5555
Patch21: CVE-2025-5244.patch
56+
Patch22: CVE-2025-7545.patch
57+
Patch23: CVE-2025-7546.patch
5658
Provides: bundled(libiberty)
5759

5860
# Moving macro before the "SourceX" tags breaks PR checks parsing the specs.
@@ -309,6 +311,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
309311
%do_files aarch64-linux-gnu %{build_aarch64}
310312

311313
%changelog
314+
* Thu Jul 17 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.37-16
315+
- Patch for CVE-2025-7545, CVE-2025-7546
316+
312317
* Mon Jun 9 2025 Akarsh Chaudhary <v-akarshc@microsoft.com>- 2.37-15
313318
- Patch CVE-2025-5245 ,CVE-2025-5244
314319

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.aarch64.rpm
1212
file-5.40-3.cm2.aarch64.rpm
1313
file-devel-5.40-3.cm2.aarch64.rpm
1414
file-libs-5.40-3.cm2.aarch64.rpm
15-
binutils-2.37-15.cm2.aarch64.rpm
16-
binutils-devel-2.37-15.cm2.aarch64.rpm
15+
binutils-2.37-16.cm2.aarch64.rpm
16+
binutils-devel-2.37-16.cm2.aarch64.rpm
1717
gmp-6.2.1-4.cm2.aarch64.rpm
1818
gmp-devel-6.2.1-4.cm2.aarch64.rpm
1919
mpfr-4.1.0-2.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ zlib-devel-1.2.13-2.cm2.x86_64.rpm
1212
file-5.40-3.cm2.x86_64.rpm
1313
file-devel-5.40-3.cm2.x86_64.rpm
1414
file-libs-5.40-3.cm2.x86_64.rpm
15-
binutils-2.37-15.cm2.x86_64.rpm
16-
binutils-devel-2.37-15.cm2.x86_64.rpm
15+
binutils-2.37-16.cm2.x86_64.rpm
16+
binutils-devel-2.37-16.cm2.x86_64.rpm
1717
gmp-6.2.1-4.cm2.x86_64.rpm
1818
gmp-devel-6.2.1-4.cm2.x86_64.rpm
1919
mpfr-4.1.0-2.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,9 @@ bash-5.1.8-4.cm2.aarch64.rpm
99
bash-debuginfo-5.1.8-4.cm2.aarch64.rpm
1010
bash-devel-5.1.8-4.cm2.aarch64.rpm
1111
bash-lang-5.1.8-4.cm2.aarch64.rpm
12-
binutils-2.37-15.cm2.aarch64.rpm
13-
binutils-debuginfo-2.37-15.cm2.aarch64.rpm
14-
binutils-devel-2.37-15.cm2.aarch64.rpm
12+
binutils-2.37-16.cm2.aarch64.rpm
13+
binutils-debuginfo-2.37-16.cm2.aarch64.rpm
14+
binutils-devel-2.37-16.cm2.aarch64.rpm
1515
bison-3.7.6-2.cm2.aarch64.rpm
1616
bison-debuginfo-3.7.6-2.cm2.aarch64.rpm
1717
bzip2-1.0.8-1.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ bash-5.1.8-4.cm2.x86_64.rpm
99
bash-debuginfo-5.1.8-4.cm2.x86_64.rpm
1010
bash-devel-5.1.8-4.cm2.x86_64.rpm
1111
bash-lang-5.1.8-4.cm2.x86_64.rpm
12-
binutils-2.37-15.cm2.x86_64.rpm
13-
binutils-aarch64-linux-gnu-2.37-15.cm2.x86_64.rpm
14-
binutils-debuginfo-2.37-15.cm2.x86_64.rpm
15-
binutils-devel-2.37-15.cm2.x86_64.rpm
12+
binutils-2.37-16.cm2.x86_64.rpm
13+
binutils-aarch64-linux-gnu-2.37-16.cm2.x86_64.rpm
14+
binutils-debuginfo-2.37-16.cm2.x86_64.rpm
15+
binutils-devel-2.37-16.cm2.x86_64.rpm
1616
bison-3.7.6-2.cm2.x86_64.rpm
1717
bison-debuginfo-3.7.6-2.cm2.x86_64.rpm
1818
bzip2-1.0.8-1.cm2.x86_64.rpm
@@ -47,7 +47,7 @@ cracklib-lang-2.9.7-5.cm2.x86_64.rpm
4747
createrepo_c-0.17.5-1.cm2.x86_64.rpm
4848
createrepo_c-debuginfo-0.17.5-1.cm2.x86_64.rpm
4949
createrepo_c-devel-0.17.5-1.cm2.x86_64.rpm
50-
cross-binutils-common-2.37-15.cm2.noarch.rpm
50+
cross-binutils-common-2.37-16.cm2.noarch.rpm
5151
cross-gcc-common-11.2.0-8.cm2.noarch.rpm
5252
curl-8.8.0-6.cm2.x86_64.rpm
5353
curl-debuginfo-8.8.0-6.cm2.x86_64.rpm

0 commit comments

Comments
 (0)