Skip to content

[AUTO-CHERRYPICK] gdb: Address CVE-2025-1176 and CVE-2025-1182 [Medium] - branch main #12959

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jslobodzian merged 1 commit into from
Mar 19, 2025
Merged

[AUTO-CHERRYPICK] gdb: Address CVE-2025-1176 and CVE-2025-1182 [Medium] - branch main #12959

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
158 changes: 158 additions & 0 deletions SPECS/gdb/CVE-2025-1176.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,158 @@
From 6741ce18a0eb447842a9d8065d32077581ecc78a Mon Sep 17 00:00:00 2001
From: Nick Clifton <nickc@redhat.com>
Date: Wed, 5 Feb 2025 11:15:11 +0000
Subject: [PATCH] Prevent illegal memory access when indexing into the
sym_hashes array of the elf bfd cookie structure.

PR 32636

Source: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f9978defb6fab0bd8583942d97c112b0932ac814
---
bfd/elflink.c | 90 +++++++++++++++++++++++++--------------------------
1 file changed, 45 insertions(+), 45 deletions(-)

diff --git a/bfd/elflink.c b/bfd/elflink.c
index 9a05208..9acfe8b 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -62,22 +62,37 @@ struct elf_find_verdep_info
static bool _bfd_elf_fix_symbol_flags
(struct elf_link_hash_entry *, struct elf_info_failed *);

-asection *
-_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
- unsigned long r_symndx,
- bool discard)
+static struct elf_link_hash_entry *
+get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
{
- if (r_symndx >= cookie->locsymcount
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
- {
- struct elf_link_hash_entry *h;
+ struct elf_link_hash_entry *h = NULL;

+ if ((r_symndx >= cookie->locsymcount
+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
+ /* Guard against corrupt input. See PR 32636 for an example. */
+ && r_symndx >= cookie->extsymoff)
+ {
h = cookie->sym_hashes[r_symndx - cookie->extsymoff];

while (h->root.type == bfd_link_hash_indirect
|| h->root.type == bfd_link_hash_warning)
h = (struct elf_link_hash_entry *) h->root.u.i.link;
+ }
+
+ return h;
+}

+asection *
+_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
+ unsigned long r_symndx,
+ bool discard)
+{
+ struct elf_link_hash_entry *h;
+
+ h = get_ext_sym_hash (cookie, r_symndx);
+
+ if (h != NULL)
+ {
if ((h->root.type == bfd_link_hash_defined
|| h->root.type == bfd_link_hash_defweak)
&& discarded_section (h->root.u.def.section))
@@ -85,21 +100,20 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
else
return NULL;
}
- else
- {
- /* It's not a relocation against a global symbol,
- but it could be a relocation against a local
- symbol for a discarded section. */
- asection *isec;
- Elf_Internal_Sym *isym;

- /* Need to: get the symbol; get the section. */
- isym = &cookie->locsyms[r_symndx];
- isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
- if (isec != NULL
- && discard ? discarded_section (isec) : 1)
- return isec;
- }
+ /* It's not a relocation against a global symbol,
+ but it could be a relocation against a local
+ symbol for a discarded section. */
+ asection *isec;
+ Elf_Internal_Sym *isym;
+
+ /* Need to: get the symbol; get the section. */
+ isym = &cookie->locsyms[r_symndx];
+ isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
+ if (isec != NULL
+ && discard ? discarded_section (isec) : 1)
+ return isec;
+
return NULL;
}

@@ -13442,22 +13456,12 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
if (r_symndx == STN_UNDEF)
return NULL;

- if (r_symndx >= cookie->locsymcount
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
+ h = get_ext_sym_hash (cookie, r_symndx);
+
+ if (h != NULL)
{
bool was_marked;

- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
- if (h == NULL)
- {
- info->callbacks->einfo (_("%F%P: corrupt input: %pB\n"),
- sec->owner);
- return NULL;
- }
- while (h->root.type == bfd_link_hash_indirect
- || h->root.type == bfd_link_hash_warning)
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
-
was_marked = h->mark;
h->mark = 1;
/* Keep all aliases of the symbol too. If an object symbol
@@ -14491,17 +14495,12 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
if (r_symndx == STN_UNDEF)
return true;

- if (r_symndx >= rcookie->locsymcount
- || ELF_ST_BIND (rcookie->locsyms[r_symndx].st_info) != STB_LOCAL)
- {
- struct elf_link_hash_entry *h;
-
- h = rcookie->sym_hashes[r_symndx - rcookie->extsymoff];
-
- while (h->root.type == bfd_link_hash_indirect
- || h->root.type == bfd_link_hash_warning)
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
+ struct elf_link_hash_entry *h;

+ h = get_ext_sym_hash (rcookie, r_symndx);
+
+ if (h != NULL)
+ {
if ((h->root.type == bfd_link_hash_defined
|| h->root.type == bfd_link_hash_defweak)
&& (h->root.u.def.section->owner != rcookie->abfd
@@ -14525,6 +14524,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
|| discarded_section (isec)))
return true;
}
+
return false;
}
return false;
--
2.34.1

29 changes: 29 additions & 0 deletions SPECS/gdb/CVE-2025-1182.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
From 296798f53ea8085bcd6ee168a57c8df0c8a1a0ef Mon Sep 17 00:00:00 2001
From: Ankita Pareek <ankitapareek@microsoft.com>
Date: Wed, 19 Feb 2025 15:43:58 +0530
Subject: [PATCH] gdb: Add patch for CVE-2025-1182 Upstream fix:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b425859021d17adf62f06fb904797cf8642986ad

Signed-off-by: Ankita Pareek <ankitapareek@microsoft.com>
---
bfd/elflink.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/bfd/elflink.c b/bfd/elflink.c
index 9acfe8b..b22fd11 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -14510,6 +14510,10 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
}
else
{
+ if (r_symndx >= rcookie->locsymcount)
+ /* This can happen with corrupt input. */
+ return false;
+
/* It's not a relocation against a global symbol,
but it could be a relocation against a local
symbol for a discarded section. */
--
2.34.1

7 changes: 6 additions & 1 deletion SPECS/gdb/gdb.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: C debugger
Name: gdb
Version: 11.2
Release: 3%{?dist}
Release: 4%{?dist}
License: GPLv2+
Vendor: Microsoft Corporation
Distribution: Mariner
Expand All @@ -11,6 +11,8 @@ Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
Patch0: CVE-2023-39128.patch
Patch1: CVE-2023-39129.patch
Patch2: CVE-2023-39130.patch
Patch3: CVE-2025-1176.patch
Patch4: CVE-2025-1182.patch
BuildRequires: expat-devel
BuildRequires: gcc-c++
BuildRequires: gcc-gfortran
Expand Down Expand Up @@ -91,6 +93,9 @@ rm -f $(dirname $(gcc -print-libgcc-file-name))/../specs
%{_mandir}/*/*

%changelog
* Thu Feb 13 2025 Ankita Pareek <ankitapareek@microsoft.com> - 11.2-4
- Address CVE-2025-1176 and CVE-2025-1182

* Tue Oct 08 2024 Mitch Zhu <mitchzhu@microsoft.com> - 11.2-3
- Fix CVE-2023-39128, CVE-2023-39129, CVE-2023-39130

Expand Down