mirror of
https://git.yoctoproject.org/poky
synced 2026-07-31 19:17:45 +02:00
72b30efa58
CVE-2025-69649: Null pointer dereference in readelf before 2.46 results in segfault when processing a crafted ELF binary with malformed header fields. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed. CVE-2025-69652: Null pointer dereference in readelf when processing a crafted ELF binary with malformed DWARF abbrev or debug information which leads to SIGABORT. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service. (From OE-Core rev: 86dd1306e350c4cd3b36a39254d6f17587960a60) Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> [YC: patches are referenced in the NVD database: https://nvd.nist.gov/vuln/detail/CVE-2025-69649 https://nvd.nist.gov/vuln/detail/CVE-2025-69652 ] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
45 lines
1.6 KiB
Diff
45 lines
1.6 KiB
Diff
From 37c8055eed3178a46417045dda63db7af21fd046 Mon Sep 17 00:00:00 2001
|
|
From: Alan Modra <amodra@gmail.com>
|
|
Date: Mon, 8 Dec 2025 15:58:33 +1030
|
|
Subject: [PATCH] PR 33697, fuzzer segfault
|
|
|
|
PR 33697
|
|
* readelf.c (process_relocs): Don't segfault on no sections.
|
|
|
|
CVE: CVE-2025-69649
|
|
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=66a3492ce68e1ae45b2489bd9a815c39ea5d7f66]
|
|
|
|
Note:
|
|
The difference between this patch on v2.42 and upstream v2.46 is due to
|
|
the loop body printing the relocations in-line, which then in commit
|
|
8e8d0b63ff15896cc2c228c01f18dfcf2a4a9305 have been factored out to a
|
|
separate 'display_relocations()' function.
|
|
|
|
See: [https://sourceware.org/git/?p=binutils-gdb.git;a=blobdiff;f=binutils/readelf.c;h=fa0de3a7e0d9c2acc18fe047a7019e09f1ce3894;hp=c1006480b7bc3e83dd87fb20d215342375614af9;hb=8e8d0b63ff15896cc2c228c01f18dfcf2a4a9305;hpb=31c21e2c13d85793b525f74aa911eb28700ed89c]
|
|
|
|
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
|
|
---
|
|
binutils/readelf.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/binutils/readelf.c b/binutils/readelf.c
|
|
index 5e4ad6ea6ad..8c1987ffaec 100644
|
|
--- a/binutils/readelf.c
|
|
+++ b/binutils/readelf.c
|
|
@@ -8961,9 +8961,9 @@ process_relocs (Filedata * filedata)
|
|
size_t i;
|
|
bool found = false;
|
|
|
|
- for (i = 0, section = filedata->section_headers;
|
|
- i < filedata->file_header.e_shnum;
|
|
- i++, section++)
|
|
+ section = filedata->section_headers;
|
|
+ if (section != NULL)
|
|
+ for (i = 0; i < filedata->file_header.e_shnum; i++, section++)
|
|
{
|
|
if ( section->sh_type != SHT_RELA
|
|
&& section->sh_type != SHT_REL
|
|
--
|
|
2.34.1
|
|
|