From 218427f362a4d1994605e40c95896a21e62fcac4 Mon Sep 17 00:00:00 2001 From: Funda Wang Date: Thu, 30 Jan 2025 15:15:16 +0800 Subject: [PATCH] fix CVE-2024-57360, CVE-2025-0840 --- backport-CVE-2025-0840.patch | 54 ++++++++++++++ binutils.spec | 16 ++++- ...l-segmentation-fault-when-displaying.patch | 71 +++++++++++++++++++ 3 files changed, 140 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-0840.patch create mode 100644 nm-Avoid-potential-segmentation-fault-when-displaying.patch diff --git a/backport-CVE-2025-0840.patch b/backport-CVE-2025-0840.patch new file mode 100644 index 0000000..6cd6b0d --- /dev/null +++ b/backport-CVE-2025-0840.patch @@ -0,0 +1,54 @@ +From baac6c221e9d69335bf41366a1c7d87d8ab2f893 Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Wed, 15 Jan 2025 19:13:43 +1030 +Subject: [PATCH] PR32560 stack-buffer-overflow at objdump disassemble_bytes + +There's always someone pushing the boundaries. + + PR 32560 + * objdump.c (MAX_INSN_WIDTH): Define. + (insn_width): Make it an unsigned long. + (disassemble_bytes): Use MAX_INSN_WIDTH to size buffer. + (main ): Restrict size of insn_width. +--- + binutils/objdump.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/binutils/objdump.c b/binutils/objdump.c +index ecbe39e942e..80044dea580 100644 +--- a/binutils/objdump.c ++++ b/binutils/objdump.c +@@ -117,7 +117,8 @@ static bool disassemble_all; /* -D */ + static int disassemble_zeroes; /* --disassemble-zeroes */ + static bool formats_info; /* -i */ + int wide_output; /* -w */ +-static int insn_width; /* --insn-width */ ++#define MAX_INSN_WIDTH 49 ++static unsigned long insn_width; /* --insn-width */ + static bfd_vma start_address = (bfd_vma) -1; /* --start-address */ + static bfd_vma stop_address = (bfd_vma) -1; /* --stop-address */ + static int dump_debugging; /* --debugging */ +@@ -3391,7 +3392,7 @@ disassemble_bytes (struct disassemble_info *inf, + } + else + { +- char buf[50]; ++ char buf[MAX_INSN_WIDTH + 1]; + unsigned int bpc = 0; + unsigned int pb = 0; + +@@ -6070,8 +6071,9 @@ main (int argc, char **argv) + break; + case OPTION_INSN_WIDTH: + insn_width = strtoul (optarg, NULL, 0); +- if (insn_width <= 0) +- fatal (_("error: instruction width must be positive")); ++ if (insn_width - 1 >= MAX_INSN_WIDTH) ++ fatal (_("error: instruction width must be in the range 1 to " ++ XSTRING (MAX_INSN_WIDTH))); + break; + case OPTION_INLINES: + unwind_inlines = true; +-- +2.43.5 + diff --git a/binutils.spec b/binutils.spec index e5eeb12..b323086 100644 --- a/binutils.spec +++ b/binutils.spec @@ -2,7 +2,7 @@ Summary: A GNU collection of binary utilities Name: binutils%{?_with_debug:-debug} Version: 2.41 -Release: 10 +Release: 11 License: GPL-3.0-or-later AND (GPL-3.0-or-later WITH Bison-exception-2.2) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND BSD-3-Clause AND GFDL-1.3-or-later AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later URL: https://sourceware.org/binutils @@ -233,6 +233,15 @@ Patch5008: binutils-gold-empty-dwp.patch # Lifetime: Permanent Patch5009: Fix-gold-linker-relocation-offset.patch +# Purpose: nm: Avoid potential segmentation fault when displaying +# symbols without version info. +# Lifetime: Fixed in 2.44 +Patch5010: nm-Avoid-potential-segmentation-fault-when-displaying.patch + +# Purpose: PR32560 stack-buffer-overflow at objdump disassemble_bytes +# Lifetime: Fixed in 2.44 +Patch5011: backport-CVE-2025-0840.patch + #---------------------------------------------------------------------------- Provides: bundled(libiberty) @@ -1247,6 +1256,11 @@ exit 0 #---------------------------------------------------------------------------- %changelog +* Sat Jan 25 2025 Funda Wang - 2.41-11 +- Fix CVE-2024-57360: nm: Avoid potential segmentation fault when displaying + symbols without version info. +- Fix CVE-2025-0840: stack-buffer-overflow at objdump disassemble_bytes + * Thu Sep 26 2024 wangding - 2.41-10 - fix gold linker relocation offset diff --git a/nm-Avoid-potential-segmentation-fault-when-displaying.patch b/nm-Avoid-potential-segmentation-fault-when-displaying.patch new file mode 100644 index 0000000..27136a7 --- /dev/null +++ b/nm-Avoid-potential-segmentation-fault-when-displaying.patch @@ -0,0 +1,71 @@ +From 5f8987d3999edb26e757115fe87be55787d510b9 Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Tue, 17 Dec 2024 09:18:57 +0000 +Subject: [PATCH] nm: Avoid potential segmentation fault when displaying + symbols without version info. + +PR 32467 +--- + binutils/nm.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/binutils/nm.c b/binutils/nm.c +index faf27c59b4d..0ba7604d34f 100644 +--- a/binutils/nm.c ++++ b/binutils/nm.c +@@ -682,7 +682,7 @@ print_symname (const char *form, struct extended_symbol_info *info, + const char *name, bfd *abfd) + { + char *alloc = NULL; +- char *atver = NULL; ++ char *atname = NULL; + + if (name == NULL) + name = info->sinfo->name; +@@ -690,9 +690,19 @@ print_symname (const char *form, struct extended_symbol_info *info, + if (!with_symbol_versions + && bfd_get_flavour (abfd) == bfd_target_elf_flavour) + { +- atver = strchr (name, '@'); ++ char *atver = strchr (name, '@'); ++ + if (atver) +- *atver = 0; ++ { ++ /* PR 32467 - Corrupt binaries might include an @ character in a ++ symbol name. Since non-versioned symbol names can be in ++ read-only memory (via memory mapping of a file's contents) we ++ cannot just replace the @ character with a NUL. Instead we ++ create a truncated copy of the name. */ ++ atname = xstrdup (name); ++ atname [atver - name] = 0; ++ name = atname; ++ } + } + + if (do_demangle && *name) +@@ -703,9 +713,7 @@ print_symname (const char *form, struct extended_symbol_info *info, + } + + if (unicode_display != unicode_default) +- { +- name = convert_utf8 (name); +- } ++ name = convert_utf8 (name); + + if (info != NULL && info->elfinfo && with_symbol_versions) + { +@@ -726,8 +734,8 @@ print_symname (const char *form, struct extended_symbol_info *info, + } + } + printf (form, name); +- if (atver) +- *atver = '@'; ++ ++ free (atname); + free (alloc); + } + +-- +2.43.5 + -- Gitee