Skip to content

[MEDIUM] Patch gcc for CVE-2021-32256 #13503

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

archana25-ms
Copy link
Contributor

@archana25-ms archana25-ms commented Apr 21, 2025

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge

Summary

What does the PR accomplish, why was it needed?
Patch gcc for CVE-2021-32256

Patch application confirmation

image

  • Upstream patch is applied cleanly without modifications
Change Log
Does this affect the toolchain?

NO

Associated issues
  • #xxxx
Links to CVEs
Test Methodology

@archana25-ms archana25-ms requested a review from a team as a code owner April 21, 2025 10:19
@archana25-ms archana25-ms force-pushed the topic_gcc-2.0 branch 2 times, most recently from 3b43161 to 3f8713b Compare April 21, 2025 10:37
@Malateshk007 Malateshk007 requested a review from a team April 22, 2025 05:57
@archana25-ms archana25-ms marked this pull request as draft April 22, 2025 06:03
@archana25-ms archana25-ms marked this pull request as ready for review April 22, 2025 06:03
Copy link
Contributor

@kgodara912 kgodara912 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Kanishk-Bansal Kanishk-Bansal requested a review from kgodara912 May 14, 2025 19:58
Copy link
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please investigate build failures

@archana25-ms archana25-ms force-pushed the topic_gcc-2.0 branch 2 times, most recently from bace534 to 19eaba8 Compare June 10, 2025 04:36
Copy link
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Buddy Build
  • patch applied during the build (check rpm.log)
  • patch include an upstream reference
  • PR has security tag

@Kanishk-Bansal Kanishk-Bansal self-requested a review June 11, 2025 18:18
@@ -474,7 +476,7 @@ $tests_ok
%files -n libgcc-devel
%defattr(-,root,root)
%{_lib64dir}/libgcc_s.so
%{_libdir}/libcc1.*
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kindly provide the reason for the removal?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Observed the following error during the build of gcc with the patches applied
image

Hence removed the above line.

@Kanishk-Bansal Kanishk-Bansal self-requested a review June 11, 2025 19:57
@Kanishk-Bansal
Copy link
Contributor

@kgodara912 need your review

@kgodara912
Copy link
Contributor

Full build

Copy link
Contributor

@kgodara912 kgodara912 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please wait before merging.

Copy link
Contributor

@kgodara912 kgodara912 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Full build is failing for this change complaining that the the shared libraries which are removed in this patch were generated in that location itself

error: Installed (but unpackaged) file(s) found:
   /usr/lib/libcc1.la
   /usr/lib/libcc1.so
   /usr/lib/libcc1.so.0
   /usr/lib/libcc1.so.0.0.0

Though our local run only produces these files in %{_lib64dir}/libcc1.* but full pipeline is producing these files in %{_libdir}/ as well. There is slight difference between local build and full build in compilation environment,
Full build (-L/lib/../lib):

libtool: link: x86_64-pc-linux-gnu-g++  -fPIC -DPIC -shared -nostdlib /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib/crti.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtbeginS.o  .libs/findcomp.o .libs/libcc1.o .libs/libcp1.o .libs/names.o .libs/callbacks.o .libs/connection.o .libs/marshall.o   -Wl,-rpath -Wl,/usr/lib/../lib -Wl,-rpath -Wl,/usr/lib/../lib -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0 -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib -L/lib/../lib -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../.. /usr/lib/../lib/libstdc++.so -lm -lc -lgcc_s /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtendS.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib/crtn.o  -m64 -mtune=generic -static-libstdc++ -static-libgcc -Wl,-z -Wl,relro -Wl,--as-needed -Wl,-z -Wl,now -Wl,-dT -Wl,/usr/src/mariner/BUILD/module_info.ld ../libiberty/pic/libiberty.a   -Wl,-soname -Wl,libcc1.so.0 -Wl,-retain-symbols-file -Wl,../../libcc1/libcc1.sym -o .libs/libcc1.so.0.0.0

While local build gives (-L/lib/../lib64/)

libtool: link: x86_64-pc-linux-gnu-g++  -fPIC -DPIC -shared -nostdlib /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib64/crti.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtbeginS.o  .libs/findcomp.o .libs/libcc1.o .libs/libcp1.o .libs/names.o .libs/callbacks.o .libs/connection.o .libs/marshall.o   -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0 -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib64 -L/lib/../lib64 -L/usr/lib/../lib64 -L/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../.. -lstdc++ -lm -lc -lgcc_s /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/crtendS.o /usr/lib/gcc/x86_64-pc-linux-gnu/11.2.0/../../../../lib64/crtn.o  -m64 -mtune=generic -static-libstdc++ -static-libgcc -Wl,-z -Wl,relro -Wl,--as-needed -Wl,-z -Wl,now -Wl,-dT -Wl,/usr/src/mariner/BUILD/module_info.ld ../libiberty/pic/libiberty.a   -Wl,-soname -Wl,libcc1.so.0 -Wl,-retain-symbols-file -Wl,../../libcc1/libcc1.sym -o .libs/libcc1.so.0.0.0

Will understand a bit more to work it on both the environments, may be by putting conditionals or why the env difference is there with both are using Azure Linux 30. Will update with proper solution.

Based on the host machine, the compilation system may not generate libcc1 files on some systems, this commit will copy those files wherever they are missing.
@kgodara912
Copy link
Contributor

Buddy build

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
main PR Destined for main Packaging security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants