From 4c29d2543f06f291d3d1ec84dbb58fffbfe0757c Mon Sep 17 00:00:00 2001 From: Harish Sadineni Date: Tue, 27 May 2025 05:13:24 -0700 Subject: [PATCH] binutils: Fix CVE-2025-1182 Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141415.html] CVE: CVE-2025-1182 (From OE-Core rev: 1e6575a4eb6168322a6560af787399267f5fa304) Signed-off-by: Harish Sadineni Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie --- .../binutils/binutils-2.44.inc | 1 + .../binutils/binutils/CVE-2025-1182.patch | 36 +++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2025-1182.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.44.inc b/meta/recipes-devtools/binutils/binutils-2.44.inc index 40a9a53310..7d1de61e10 100644 --- a/meta/recipes-devtools/binutils/binutils-2.44.inc +++ b/meta/recipes-devtools/binutils/binutils-2.44.inc @@ -37,5 +37,6 @@ SRC_URI = "\ file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \ file://0015-CVE-2025-1178.patch \ file://CVE-2025-1180.patch \ + file://CVE-2025-1182.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1182.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1182.patch new file mode 100644 index 0000000000..4a3b6f072b --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1182.patch @@ -0,0 +1,36 @@ +From 92bcd04fcd97f261ff40e9248e00a1dbebf3a536 Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Tue, 27 May 2025 03:37:50 -0700 +Subject: [PATCH] Backport fix for PR 32644(CVE-2025-1182) + +Fix another illegal memory access triggered by corrupt ELF input files. + +PR 32644 + +(cherry picked from commit:b425859021d17adf62f06fb904797cf8642986ad) +Upstream-Status: Submitted [https://sourceware.org/pipermail/binutils/2025-May/141415.html] +CVE: CVE-2025-1182 + +Signed-off-by: Harish Sadineni +--- + bfd/elflink.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/bfd/elflink.c b/bfd/elflink.c +index 6346d7e2b4b..a0b237b2224 100644 +--- a/bfd/elflink.c ++++ b/bfd/elflink.c +@@ -15084,6 +15084,10 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie) + } + else + { ++ if (r_symndx >= rcookie->locsymcount) ++ /* This can happen with corrupt input. */ ++ return false; ++ + /* It's not a relocation against a global symbol, + but it could be a relocation against a local + symbol for a discarded section. */ +-- +2.49.0 +