From f456088fe2708d5ce79d709aca7380ab21242362 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 30 Mar 2026 10:26:44 -0400 Subject: [PATCH] import CS gcc-toolset-15-binutils-2.44-5.el9 --- SOURCES/binutils-CVE-2025-11083.patch | 71 +++++++++++++++++++++++++++ SPECS/binutils.spec | 18 ++++++- 2 files changed, 87 insertions(+), 2 deletions(-) create mode 100644 SOURCES/binutils-CVE-2025-11083.patch diff --git a/SOURCES/binutils-CVE-2025-11083.patch b/SOURCES/binutils-CVE-2025-11083.patch new file mode 100644 index 0000000..cb250b2 --- /dev/null +++ b/SOURCES/binutils-CVE-2025-11083.patch @@ -0,0 +1,71 @@ +From 9ca499644a21ceb3f946d1c179c38a83be084490 Mon Sep 17 00:00:00 2001 +From: "H.J. Lu" +Date: Thu, 18 Sep 2025 16:59:25 -0700 +Subject: [PATCH] elf: Don't match corrupt section header in linker input + +Don't swap in nor match corrupt section header in linker input to avoid +linker crash later. + + PR ld/33457 + * elfcode.h (elf_swap_shdr_in): Changed to return bool. Return + false for corrupt section header in linker input. + (elf_object_p): Reject if elf_swap_shdr_in returns false. + +Signed-off-by: H.J. Lu +--- + bfd/elfcode.h | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- binutils-with-gold-2.44.orig/bfd/elfcode.h 2025-11-26 15:41:49.547812496 +0000 ++++ binutils-with-gold-2.44/bfd/elfcode.h 2025-11-26 15:43:23.570202970 +0000 +@@ -311,7 +311,7 @@ elf_swap_ehdr_out (bfd *abfd, + /* Translate an ELF section header table entry in external format into an + ELF section header table entry in internal format. */ + +-static void ++static bool + elf_swap_shdr_in (bfd *abfd, + const Elf_External_Shdr *src, + Elf_Internal_Shdr *dst) +@@ -341,6 +341,9 @@ elf_swap_shdr_in (bfd *abfd, + { + _bfd_error_handler (_("warning: %pB has a section " + "extending past end of file"), abfd); ++ /* PR ld/33457: Don't match corrupt section header. */ ++ if (abfd->is_linker_input) ++ return false; + abfd->read_only = 1; + } + } +@@ -350,6 +353,7 @@ elf_swap_shdr_in (bfd *abfd, + dst->sh_entsize = H_GET_WORD (abfd, src->sh_entsize); + dst->bfd_section = NULL; + dst->contents = NULL; ++ return true; + } + + /* Translate an ELF section header table entry in internal format into an +@@ -642,9 +646,9 @@ elf_object_p (bfd *abfd) + + /* Read the first section header at index 0, and convert to internal + form. */ +- if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)) ++ if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr) ++ || !elf_swap_shdr_in (abfd, &x_shdr, &i_shdr)) + goto got_no_match; +- elf_swap_shdr_in (abfd, &x_shdr, &i_shdr); + + /* If the section count is zero, the actual count is in the first + section header. */ +@@ -730,9 +734,9 @@ elf_object_p (bfd *abfd) + to internal form. */ + for (shindex = 1; shindex < i_ehdrp->e_shnum; shindex++) + { +- if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr)) ++ if (bfd_read (&x_shdr, sizeof x_shdr, abfd) != sizeof (x_shdr) ++ || !elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex)) + goto got_no_match; +- elf_swap_shdr_in (abfd, &x_shdr, i_shdrp + shindex); + + /* Sanity check sh_link and sh_info. */ + if (i_shdrp[shindex].sh_link >= num_sec) diff --git a/SPECS/binutils.spec b/SPECS/binutils.spec index 1063e25..6e171f0 100644 --- a/SPECS/binutils.spec +++ b/SPECS/binutils.spec @@ -24,7 +24,7 @@ Name: %{?scl_prefix}binutils # The variable %%{source} (see below) should be set to indicate which of these # origins is being used. Version: 2.44 -Release: 3%{?dist} +Release: 5%{?dist} License: GPL-3.0-or-later AND (GPL-3.0-or-later WITH Bison-exception-2.2) AND (LGPL-2.0-or-later WITH GCC-exception-2.0) AND BSD-3-Clause AND GFDL-1.3-or-later AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later URL: https://sourceware.org/binutils @@ -148,7 +148,7 @@ URL: https://sourceware.org/binutils # Bootstrapping: Set this to 1 to build the binutils with the system gcc. # Then once GTS-gcc is built and in the buildroot, reset this variable # to 0, bump the NVR and rebuild GTS-binutils. -%define bootstrapping 1 +%define bootstrapping 0 #----End of Configure Options------------------------------------------------ @@ -331,6 +331,11 @@ Patch18: binutils-fix-ar-test.patch # Lifetime: Fixed in 2.45 Patch19: binutils-aarch64-small-plt0.patch +# Purpose: Stops a potential illegal memory access when linking a corrupt +# input file. PR 33457 +# Lifetime: Fixed in 2.46 +Patch20: binutils-CVE-2025-11083.patch + #---------------------------------------------------------------------------- # Purpose: Suppress the x86 linker's p_align-1 tests due to kernel bug on CentOS-10 @@ -383,6 +388,9 @@ BuildRequires: clang compiler-rt %define gcc_package %{?scl_prefix}gcc %define gxx_package %{?scl_prefix}gcc-c++ +# FIXME: gcc-annobin.so is not currently built... +%undefine _annotated_build + %if 0%{rhel} < 9 BuildRequires: %{?scl_prefix}annobin-plugin-gcc %endif @@ -1568,6 +1576,12 @@ exit 0 #---------------------------------------------------------------------------- %changelog +* Wed Nov 26 2025 Nick Clifton - 2.44-5 +- Fix a potential illegal memory access when linking a corrupt input file. (RHEL-130670) + +* Mon Sep 08 2025 Nick Clifton - 2.44-4 +- Disable bootstrapping. (RHEL-112561) + * Mon May 12 2025 Siddhesh Poyarekar - 2.44-3 - Avoid using SCL for c10s.