mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

binutils: fix CVE-2026-18220

Browse Source 
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-18220
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=114e3aae2b7e34057c8909301eaf78c15687e8e5

Test results:
  binutils-cross-testsuite 2.42 (x86_64-oe-linux):

  Before:
  binutils: 302 passed, 2 unexpected failures, 1 untested, 7 unsupported
  gas:      1871 passed, 4 unexpected failures, 2 unsupported
  ld:       1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported

  After:
  binutils: 304 passed, 2 unexpected failures, 1 untested, 7 unsupported
  gas:      1871 passed, 4 unexpected failures, 2 unsupported
  ld:       1728 passed, 5 unexpected failures, 7 expected failures, 1 unresolved, 20 untested, 99 unsupported

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=114e3aae2b7e34057c8909301eaf78c15687e8e5]
(From OE-Core rev: c9f3a2e7641af10ef9c43359a805191356fe0d67)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Jaipaul Cheernam
2026-08-12 12:54:45 +02:00
committed by Richard Purdie
parent 5c215d3c91
commit 2a1e2de813
2 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/binutils/binutils-2.42.inc
View File

@@ -81,5 +81,6 @@ SRC_URI = "\
file://CVE-2025-1147.patch \
file://CVE-2025-8224.patch \
file://CVE-2026-15003.patch \
file://CVE-2026-18220.patch \
"
S = "${WORKDIR}/git"

65
meta/recipes-devtools/binutils/binutils/CVE-2026-18220.patch Normal file
View File

@@ -0,0 +1,65 @@
From 114e3aae2b7e34057c8909301eaf78c15687e8e5 Mon Sep 17 00:00:00 2001
From: Alan Modra <amodra@gmail.com>
Date: Sun, 28 Jun 2026 09:11:46 +0930
Subject: [PATCH] asan: buffer overflow in elf32_dlx_relocate26
* elf32-dlx.c (elf32_dlx_relocate26): Sanity check reloc offset.
(elf32_dlx_relocate16): Likewise.
(_bfd_dlx_elf_hi16_reloc): Likewise, and remove ineffective
existing check.
CVE: CVE-2026-18220
Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=114e3aae2b7e34057c8909301eaf78c15687e8e5]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
bfd/elf32-dlx.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/bfd/elf32-dlx.c b/bfd/elf32-dlx.c
index 2dfeb4d7390..0f9a49695d7 100644
--- a/bfd/elf32-dlx.c
+++ b/bfd/elf32-dlx.c
@@ -77,6 +77,10 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd,
return bfd_reloc_ok;
}
+ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd,
+ input_section, reloc_entry->address))
+ return bfd_reloc_outofrange;
+
ret = bfd_reloc_ok;
if (bfd_is_und_section (symbol->section)
@@ -89,9 +93,6 @@ _bfd_dlx_elf_hi16_reloc (bfd *abfd,
relocation += reloc_entry->addend;
relocation += bfd_get_16 (abfd, (bfd_byte *)data + reloc_entry->address);
- if (reloc_entry->address > bfd_get_section_limit (abfd, input_section))
- return bfd_reloc_outofrange;
-
bfd_put_16 (abfd, (short)((relocation >> 16) & 0xFFFF),
(bfd_byte *)data + reloc_entry->address);
@@ -143,6 +144,10 @@ elf32_dlx_relocate16 (bfd *abfd,
return bfd_reloc_undefined;
}
+ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd,
+ input_section, reloc_entry->address))
+ return bfd_reloc_outofrange;
+
insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address);
allignment = 1 << (input_section->output_section->alignment_power - 1);
vallo = insn & 0x0000FFFF;
@@ -206,6 +211,10 @@ elf32_dlx_relocate26 (bfd *abfd,
return bfd_reloc_undefined;
}
+ if (!bfd_reloc_offset_in_range (reloc_entry->howto, abfd,
+ input_section, reloc_entry->address))
+ return bfd_reloc_outofrange;
+
insn = bfd_get_32 (abfd, (bfd_byte *)data + reloc_entry->address);
allignment = 1 << (input_section->output_section->alignment_power - 1);
vallo = insn & 0x03FFFFFF;