Commit Graph

6 Commits

Author SHA1 Message Date
Deepesh Varatharajan
9786fca4f6 binutils: Fix CVE-2025-1178
Prevent an abort in the bfd linker when attempting to
generate dynamic relocs for a corrupt input file.

PR 32638

Backport a patch from upstream to fix CVE-2025-1178
Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0]

(From OE-Core rev: f58f174daa7e30baa18abe4db9eda9c1b1c425cc)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-05-22 14:36:49 +01:00
Peter Marko
ebf9d387cc binutils: mark CVE-2025-1153 as fixed
We had this CVE patched but the patch was removed with last 2.44 branch
updates as it is now included.
Since there is no new version which could be set in NVD DB, this needs
to be explicitly handled.

(From OE-Core rev: 32f18145dee54f61203506daef339cd132908287)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-05-05 17:22:11 +01:00
Peter Marko
1b5d6bb30d binutils: drop obsolete CVE_STATUS
NVD has CVE-2023-25584 listed as < 2.40, so we don't need to ignore it
for version 2.44 anymore.

(From OE-Core rev: eaf80096f96e5bebed53076c1dfe7e35e539f383)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-05-05 17:22:11 +01:00
Deepesh Varatharajan
0ee82d7740 binutils: stable 2.44 branch updates
Below commits on binutils-2.44 stable branch are updated.

fe459e33c67 PR 32603, revert message changes in 0b7f992b78fe and 31e9e2e8d109
37d12dd25d8 gdb/compile: add missing entry in bfd_link_callbacks array
31e9e2e8d10 PR 32603, more ld -w misbehaviour
0b7f992b78f PR 32603, ld -w misbehaviour
8cb98edf123 s390: Add support for z17 as CPU name
ed70d86b491 x86: Remove AVX10.2 256 bit rounding support
e1af7e590a5 elf: Clear the SEC_ALLOC bit for NOLOAD note sections
35db8c6dd2f ld: Pass -Wl,-z,lazy to compiler for i386 lazy binding tests
cc7ec316a45 Updated translations for bfd and gold
bf088ee09a7 PR 32731 ub sanitizer accessing filenames_reversed
78082591ec7 score-elf gas SEGV
d4c7ee9fbc1 gas: fix rs_fill_nop listing
a68d096a0ab Open the 2.44 branch for further development

Dropped: 0015-CVE-2025-1153.patch

Testing was done and there were no regressions found

(From OE-Core rev: 749bdd5bda6f9b5af8d63794858bbb9834294fcb)

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-05-01 14:22:53 +01:00
Peter Marko
5f26d71861 binutils: patch CVE-2025-1153
Pick patch [1] mentioned in NVD report [2]

[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-1153

(From OE-Core rev: bc3c169d78dac9d2e83c533056b8bec8dbdab3f7)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-03-17 17:09:22 +00:00
Khem Raj
7c65f1da17 binutils: Upgrade to 2.44 release
* Drop the CVE-2024-53589 patch, its included in 2.44
* Package newly rename gp-* to gprofng-* binaries and remove old gp-*
  symlinks

* Gold linker is now deprecated and will be removed in future release
  its already deleted in tarball releases

* Support for the Nios II target has been removed.

* Assembler:
    - Support for new architecture extensions for AArch64, Risc-V and
      x86.

* Linker:
      The default maximum page size was changed from 16KiB to 64KiB for
      LoongArch.

      This now supports mixed LTO and non-LTO object files in
      relocatable output.

      The ELF forms of the linker support a --image-base=<ADDR> option
      for compatibility with LLD.

      The --build-id= option now accepts an argument of "xx" which
      enables the use of the xxhash library.  This produces a 128-bit
      hash and is 2-4x faster than md5 or sha1.

      The ELF linker option --package-metadata supports percent-encoded
      and %[string] encoded JSON payloads.

* Disassembler:
      The RISC-V disassembler now supports -M,max option like QEMU to
      dump instruction without checking architecture support as usual.

* GprofNG:
      Support added for hardware event counters for Neoverse-N1,
      Ampere-1, and Appliedmicro processors.

Detailed release notes [1]

[1] https://lists.gnu.org/archive/html/info-gnu/2025-02/msg00001.html

(From OE-Core rev: df3c43e69542939a4bec3893f1e927edf2ad7179)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2025-02-05 12:49:56 +00:00