diff --git a/binutils-CVE-2025-5244.patch b/binutils-CVE-2025-5244.patch new file mode 100644 index 0000000..d76e588 --- /dev/null +++ b/binutils-CVE-2025-5244.patch @@ -0,0 +1,22 @@ +# commit d1458933830456e54223d9fc61f0d9b3a19256f5 +# tree 98864afbaa67a592824cc9f0c846bce8efde33c9 tree +# parent 6fe4e5bd10b996428a557e036c07c5839a8e0a49 commit | diff +# PR32858 ld segfault on fuzzed object +# +# We missed one place where it is necessary to check for empty groups. +# +# PR 32858 +# * elflink.c (elf_gc_sweep): Protect against empty group. + +--- binutils.orig/bfd/elflink.c 2025-06-30 15:59:11.706908490 +0100 ++++ binutils-2.41/bfd/elflink.c 2025-06-30 16:00:32.282299523 +0100 +@@ -14115,7 +14115,8 @@ elf_gc_sweep (bfd *abfd, struct bfd_link + if (o->flags & SEC_GROUP) + { + asection *first = elf_next_in_group (o); +- o->gc_mark = first->gc_mark; ++ if (first != NULL) ++ o->gc_mark = first->gc_mark; + } + + if (o->gc_mark) diff --git a/binutils.spec b/binutils.spec index f7582ef..e757fb4 100644 --- a/binutils.spec +++ b/binutils.spec @@ -2,7 +2,7 @@ Summary: A GNU collection of binary utilities Name: binutils%{?_with_debug:-debug} Version: 2.41 -Release: 56%{?dist}.alma.1 +Release: 57%{?dist}.alma.1 License: GPL-3.0-or-later AND (GPL-3.0-or-later WITH Bison-exception-2.2) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND BSD-3-Clause AND GFDL-1.3-or-later AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later URL: https://sourceware.org/binutils @@ -386,12 +386,11 @@ Patch60: binutils-s390-z17-cpu-name.patch # Lifetime: Fixed in 2.42 Patch61: binutils-riscv-efi.patch -#---------------------------------------------------------------------------- +# Purpose: Fix a potential NULL pointer dereference when parsing a corrupt ELF file. +# Lifetime: Fixed in 2.45 +Patch62: binutils-CVE-2025-5244.patch -# Purpose: Workaround for an unresolved bug in ppc gcc -# which generates bad code in the linker. cf RHEL-49348 -# Lifetime: TEMPORARY -Patch98: bin.ppc64.gcc.patch +#---------------------------------------------------------------------------- # Purpose: Suppress the x86 linker's p_align-1 tests due to kernel bug on CentOS-10 # Lifetime: TEMPORARY @@ -916,6 +915,13 @@ build_target() pushd $builddir +%if 0%{?rhel} == 10 +# Work around https://issues.redhat.com/browse/RHEL-49348 +%ifarch ppc64le +export GLIBC_TUNABLES=glibc.cpu.hwcaps=-arch_3_1 +%endif +%endif + %if %{with docs} # Because of parallel building, info has to be made after all. %make_build %{_smp_mflags} tooldir=%{_prefix} all @@ -1437,11 +1443,15 @@ exit 0 #---------------------------------------------------------------------------- %changelog -* Fri Jun 13 2025 Andrew Lukoshko - 2.41-56.alma.1 +* Wed Jul 02 2025 Andrew Lukoshko - 2.41-57.alma.1 - Add bison to BuildRequires for RISC-V - Disable LTO for RISC-V - Disable testsuite for RISC-V +* Mon Jun 30 2025 Nick Clifton - 2.41-57 +- Add fix for CVE-2025-5244. (RHEL-100417) +- USe correct fix for CVE-2025-5702. (RHEL-100159) + * Mon Apr 28 2025 Andrea Bolognani - 2.41-56 - Add basic support for RISC-V 64-bit EFI objects. (RHEL-88815)