mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
72b30efa58
CVE-2025-69649: Null pointer dereference in readelf before 2.46 results in segfault when processing a crafted ELF binary with malformed header fields. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed. CVE-2025-69652: Null pointer dereference in readelf when processing a crafted ELF binary with malformed DWARF abbrev or debug information which leads to SIGABORT. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service. (From OE-Core rev: 86dd1306e350c4cd3b36a39254d6f17587960a60) Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> [YC: patches are referenced in the NVD database: https://nvd.nist.gov/vuln/detail/CVE-2025-69649 https://nvd.nist.gov/vuln/detail/CVE-2025-69652 ] Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
40 lines
1.2 KiB
Diff
40 lines
1.2 KiB
Diff
From cb4f8fe24cc86a9f050be4cf9c619940f632ea6a Mon Sep 17 00:00:00 2001
|
|
From: Alan Modra <amodra@gmail.com>
|
|
Date: Mon, 8 Dec 2025 16:04:44 +1030
|
|
Subject: [PATCH] PR 33701, abort in byte_get_little_endian
|
|
|
|
PR 33701
|
|
* dwarf.c (process_debug_info): Set debug_info_p NULL when
|
|
DEBUG_INFO_UNAVAILABLE.
|
|
|
|
CVE: CVE-2025-69652
|
|
Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=44b79abd0fa12e7947252eb4c6e5d16ed6033e01]
|
|
|
|
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
|
|
---
|
|
binutils/dwarf.c | 8 +++++---
|
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/binutils/dwarf.c b/binutils/dwarf.c
|
|
index 615e051b2bf..13b11b46e41 100644
|
|
--- a/binutils/dwarf.c
|
|
+++ b/binutils/dwarf.c
|
|
@@ -4222,9 +4222,11 @@ process_debug_info (struct dwarf_section * section,
|
|
break;
|
|
}
|
|
|
|
- debug_info *debug_info_p =
|
|
- (debug_information && unit < alloc_num_debug_info_entries)
|
|
- ? debug_information + unit : NULL;
|
|
+ debug_info *debug_info_p = NULL;
|
|
+ if (debug_information
|
|
+ && num_debug_info_entries != DEBUG_INFO_UNAVAILABLE
|
|
+ && unit < alloc_num_debug_info_entries)
|
|
+ debug_info_p = debug_information + unit;
|
|
|
|
assert (!debug_info_p
|
|
|| (debug_info_p->num_loc_offsets
|
|
--
|
|
2.34.1
|
|
|