Skip to content

Commit 4e73a0b

Browse files
zengweiZeno-sole
zengwei
authored and
Zeno-sole
committed
CVE-2025-1182 CVE-2025-3198 CVE-2025-5244 CVE-2025-5245 CVE-2025-7545 CVE-2025-7546 CVE-2025-8225
1 parent dcdd57b commit 4e73a0b

14 files changed

Lines changed: 770 additions & 0 deletions

‎debian/changelog‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
1+
binutils (2.41-6deepin10) unstable; urgency=medium
2+
3+
* fix CVE-2024-57360 CVE-2024-53589 CVE-2025-0840 CVE-2025-1176 CVE-2025-1178
4+
CVE-2025-1182 CVE-2025-3198 CVE-2025-5244 CVE-2025-5245
5+
CVE-2025-7545 CVE-2025-7546 CVE-2025-8225
6+
7+
-- zengwei <zengwei1@uniontech.com> Fri, 31 Oct 2025 16:12:25 +0800
8+
19
binutils (2.41-6deepin9) unstable; urgency=medium
210

311
* feat: add sw64 support.

‎debian/patches/0001-CVE-2025-1176.patch‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
From 94b928448447a2b00d008315fc362e93c2842689 Mon Sep 17 00:00:00 2001
2+
From: zengwei <zengwei1@uniontech.com>
3+
Date: Fri, 31 Oct 2025 15:35:05 +0800
4+
Subject: [PATCH] CVE-2025-1176
5+
6+
---
7+
bfd/elflink.c | 87 ++++++++++++++++++++++++++-------------------------
8+
1 file changed, 44 insertions(+), 43 deletions(-)
9+
10+
diff --git a/bfd/elflink.c b/bfd/elflink.c
11+
index 7217c2f0..161cdf8d 100644
12+
--- a/bfd/elflink.c
13+
+++ b/bfd/elflink.c
14+
@@ -62,22 +62,38 @@ struct elf_find_verdep_info
15+
static bool _bfd_elf_fix_symbol_flags
16+
(struct elf_link_hash_entry *, struct elf_info_failed *);
17+
18+
-asection *
19+
-_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
20+
- unsigned long r_symndx,
21+
- bool discard)
22+
+static struct elf_link_hash_entry *
23+
+get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
24+
{
25+
- if (r_symndx >= cookie->locsymcount
26+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
27+
+ struct elf_link_hash_entry *h = NULL;
28+
+
29+
+ if ((r_symndx >= cookie->locsymcount
30+
+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
31+
+ /* Guard against corrupt input. See PR 32636 for an example. */
32+
+ && r_symndx >= cookie->extsymoff)
33+
{
34+
- struct elf_link_hash_entry *h;
35+
36+
h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
37+
38+
while (h->root.type == bfd_link_hash_indirect
39+
|| h->root.type == bfd_link_hash_warning)
40+
h = (struct elf_link_hash_entry *) h->root.u.i.link;
41+
+ }
42+
+
43+
+ return h;
44+
+}
45+
+
46+
+asection *
47+
+_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
48+
+ unsigned long r_symndx,
49+
+ bool discard)
50+
+{
51+
+ struct elf_link_hash_entry *h;
52+
53+
+ h = get_ext_sym_hash (cookie, r_symndx);
54+
+
55+
+ if (h != NULL)
56+
+ {
57+
if ((h->root.type == bfd_link_hash_defined
58+
|| h->root.type == bfd_link_hash_defweak)
59+
&& discarded_section (h->root.u.def.section))
60+
@@ -85,21 +101,19 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
61+
else
62+
return NULL;
63+
}
64+
- else
65+
- {
66+
- /* It's not a relocation against a global symbol,
67+
- but it could be a relocation against a local
68+
- symbol for a discarded section. */
69+
- asection *isec;
70+
- Elf_Internal_Sym *isym;
71+
+ /* It's not a relocation against a global symbol,
72+
+ but it could be a relocation against a local
73+
+ symbol for a discarded section. */
74+
+ asection *isec;
75+
+ Elf_Internal_Sym *isym;
76+
+
77+
+ /* Need to: get the symbol; get the section. */
78+
+ isym = &cookie->locsyms[r_symndx];
79+
+ isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
80+
+ if (isec != NULL
81+
+ && discard ? discarded_section (isec) : 1)
82+
+ return isec;
83+
84+
- /* Need to: get the symbol; get the section. */
85+
- isym = &cookie->locsyms[r_symndx];
86+
- isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
87+
- if (isec != NULL
88+
- && discard ? discarded_section (isec) : 1)
89+
- return isec;
90+
- }
91+
return NULL;
92+
}
93+
94+
@@ -13731,22 +13745,12 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
95+
if (r_symndx == STN_UNDEF)
96+
return NULL;
97+
98+
- if (r_symndx >= cookie->locsymcount
99+
- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
100+
+ h = get_ext_sym_hash (cookie, r_symndx);
101+
+
102+
+ if (h != NULL)
103+
{
104+
bool was_marked;
105+
106+
- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
107+
- if (h == NULL)
108+
- {
109+
- info->callbacks->einfo (_("%F%P: corrupt input: %pB\n"),
110+
- sec->owner);
111+
- return NULL;
112+
- }
113+
- while (h->root.type == bfd_link_hash_indirect
114+
- || h->root.type == bfd_link_hash_warning)
115+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
116+
-
117+
was_marked = h->mark;
118+
h->mark = 1;
119+
/* Keep all aliases of the symbol too. If an object symbol
120+
@@ -14792,16 +14796,12 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
121+
if (r_symndx == STN_UNDEF)
122+
return true;
123+
124+
- if (r_symndx >= rcookie->locsymcount
125+
- || ELF_ST_BIND (rcookie->locsyms[r_symndx].st_info) != STB_LOCAL)
126+
- {
127+
- struct elf_link_hash_entry *h;
128+
-
129+
- h = rcookie->sym_hashes[r_symndx - rcookie->extsymoff];
130+
+ struct elf_link_hash_entry *h;
131+
132+
- while (h->root.type == bfd_link_hash_indirect
133+
- || h->root.type == bfd_link_hash_warning)
134+
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
135+
+ h = get_ext_sym_hash (rcookie, r_symndx);
136+
+
137+
+ if (h != NULL)
138+
+ {
139+
140+
if ((h->root.type == bfd_link_hash_defined
141+
|| h->root.type == bfd_link_hash_defweak)
142+
@@ -14826,6 +14826,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
143+
|| discarded_section (isec)))
144+
return true;
145+
}
146+
+
147+
return false;
148+
}
149+
return false;
150+
--
151+
2.20.1
152+

‎debian/patches/0001-CVE-2025-1182.patch‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
From 9cd7e6d60bf90fa374b0dab8b779e2bb0edf44e7 Mon Sep 17 00:00:00 2001
2+
From: zengwei <zengwei1@uniontech.com>
3+
Date: Fri, 31 Oct 2025 15:51:53 +0800
4+
Subject: [PATCH] CVE-2025-1182
5+
6+
---
7+
bfd/elflink.c | 6 +++++-
8+
1 file changed, 5 insertions(+), 1 deletion(-)
9+
10+
diff --git a/bfd/elflink.c b/bfd/elflink.c
11+
index 161cdf8d..7c560027 100644
12+
--- a/bfd/elflink.c
13+
+++ b/bfd/elflink.c
14+
@@ -14812,6 +14812,10 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
15+
}
16+
else
17+
{
18+
+ if (r_symndx >= rcookie->locsymcount)
19+
+ /* This can happen with corrupt input. */
20+
+ return false;
21+
+
22+
/* It's not a relocation against a global symbol,
23+
but it could be a relocation against a local
24+
symbol for a discarded section. */
25+
@@ -14826,7 +14830,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
26+
|| discarded_section (isec)))
27+
return true;
28+
}
29+
-
30+
+
31+
return false;
32+
}
33+
return false;
34+
--
35+
2.20.1
36+

‎debian/patches/0001-CVE-2025-5244.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From ed1ce52a7177dc1d103b751c875a2c188aea8a8a Mon Sep 17 00:00:00 2001
2+
From: zengwei <zengwei1@uniontech.com>
3+
Date: Fri, 31 Oct 2025 15:54:53 +0800
4+
Subject: [PATCH] CVE-2025-5244
5+
6+
---
7+
bfd/elflink.c | 4 ++--
8+
1 file changed, 2 insertions(+), 2 deletions(-)
9+
10+
diff --git a/bfd/elflink.c b/bfd/elflink.c
11+
index 7c560027..55fbaabe 100644
12+
--- a/bfd/elflink.c
13+
+++ b/bfd/elflink.c
14+
@@ -14090,8 +14090,8 @@ elf_gc_sweep (bfd *abfd, struct bfd_link_info *info)
15+
if (o->flags & SEC_GROUP)
16+
{
17+
asection *first = elf_next_in_group (o);
18+
- o->gc_mark = first->gc_mark;
19+
- }
20+
+ if (first != NULL)
21+
+ o->gc_mark = first->gc_mark; }
22+
23+
if (o->gc_mark)
24+
continue;
25+
--
26+
2.20.1
27+

‎debian/patches/CVE-2024-53589.patch‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
From e0323071916878e0634a6e24d8250e4faff67e88 Mon Sep 17 00:00:00 2001
2+
From: Alan Modra <amodra@gmail.com>
3+
Date: Mon, 11 Nov 2024 10:24:09 +1030
4+
Subject: [PATCH] Re: tekhex object file output fixes
5+
6+
Commit 8b5a212495 supported *ABS* symbols by allowing "section" to be
7+
bfd_abs_section, but bfd_abs_section needs to be treated specially.
8+
In particular, bfd_get_next_section_by_name (.., bfd_abs_section_ptr)
9+
is invalid.
10+
11+
PR 32347
12+
* tekhex.c (first_phase): Guard against modification of
13+
_bfd_std_section[] entries.
14+
---
15+
bfd/tekhex.c | 38 ++++++++++++++++++++------------------
16+
1 file changed, 20 insertions(+), 18 deletions(-)
17+
18+
diff --git a/bfd/tekhex.c b/bfd/tekhex.c
19+
index aea2ebb23df..b305c1f96f1 100644
20+
--- a/bfd/tekhex.c
21+
+++ b/bfd/tekhex.c
22+
@@ -361,6 +361,7 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
23+
{
24+
asection *section, *alt_section;
25+
unsigned int len;
26+
+ bfd_vma addr;
27+
bfd_vma val;
28+
char sym[17]; /* A symbol can only be 16chars long. */
29+
30+
@@ -368,20 +369,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
31+
{
32+
case '6':
33+
/* Data record - read it and store it. */
34+
- {
35+
- bfd_vma addr;
36+
-
37+
- if (!getvalue (&src, &addr, src_end))
38+
- return false;
39+
-
40+
- while (*src && src < src_end - 1)
41+
- {
42+
- insert_byte (abfd, HEX (src), addr);
43+
- src += 2;
44+
- addr++;
45+
- }
46+
- return true;
47+
- }
48+
+ if (!getvalue (&src, &addr, src_end))
49+
+ return false;
50+
+
51+
+ while (*src && src < src_end - 1)
52+
+ {
53+
+ insert_byte (abfd, HEX (src), addr);
54+
+ src += 2;
55+
+ addr++;
56+
+ }
57+
+ return true;
58+
59+
case '3':
60+
/* Symbol record, read the segment. */
61+
@@ -406,13 +403,16 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
62+
{
63+
case '1': /* Section range. */
64+
src++;
65+
- if (!getvalue (&src, &section->vma, src_end))
66+
+ if (!getvalue (&src, &addr, src_end))
67+
return false;
68+
if (!getvalue (&src, &val, src_end))
69+
return false;
70+
- if (val < section->vma)
71+
- val = section->vma;
72+
- section->size = val - section->vma;
73+
+ if (bfd_is_const_section (section))
74+
+ break;
75+
+ section->vma = addr;
76+
+ if (val < addr)
77+
+ val = addr;
78+
+ section->size = val - addr;
79+
/* PR 17512: file: objdump-s-endless-loop.tekhex.
80+
Check for overlarge section sizes. */
81+
if (section->size & 0x80000000)
82+
@@ -455,6 +455,8 @@ first_phase (bfd *abfd, int type, char *src, char * src_end)
83+
new_symbol->symbol.flags = BSF_LOCAL;
84+
if (stype == '2' || stype == '6')
85+
new_symbol->symbol.section = bfd_abs_section_ptr;
86+
+ else if (bfd_is_const_section (section))
87+
+ ;
88+
else if (stype == '3' || stype == '7')
89+
{
90+
if ((section->flags & SEC_DATA) == 0)
91+
--
92+
2.43.7

‎debian/patches/CVE-2025-0840.patch‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
From baac6c221e9d69335bf41366a1c7d87d8ab2f893 Mon Sep 17 00:00:00 2001
2+
From: Alan Modra <amodra@gmail.com>
3+
Date: Wed, 15 Jan 2025 19:13:43 +1030
4+
Subject: [PATCH] PR32560 stack-buffer-overflow at objdump disassemble_bytes
5+
6+
There's always someone pushing the boundaries.
7+
8+
PR 32560
9+
* objdump.c (MAX_INSN_WIDTH): Define.
10+
(insn_width): Make it an unsigned long.
11+
(disassemble_bytes): Use MAX_INSN_WIDTH to size buffer.
12+
(main <OPTION_INSN_WIDTH>): Restrict size of insn_width.
13+
---
14+
binutils/objdump.c | 10 ++++++----
15+
1 file changed, 6 insertions(+), 4 deletions(-)
16+
17+
diff --git a/binutils/objdump.c b/binutils/objdump.c
18+
index ecbe39e942e..80044dea580 100644
19+
--- a/binutils/objdump.c
20+
+++ b/binutils/objdump.c
21+
@@ -117,7 +117,8 @@ static bool disassemble_all; /* -D */
22+
static int disassemble_zeroes; /* --disassemble-zeroes */
23+
static bool formats_info; /* -i */
24+
int wide_output; /* -w */
25+
-static int insn_width; /* --insn-width */
26+
+#define MAX_INSN_WIDTH 49
27+
+static unsigned long insn_width; /* --insn-width */
28+
static bfd_vma start_address = (bfd_vma) -1; /* --start-address */
29+
static bfd_vma stop_address = (bfd_vma) -1; /* --stop-address */
30+
static int dump_debugging; /* --debugging */
31+
@@ -3391,7 +3392,7 @@ disassemble_bytes (struct disassemble_info *inf,
32+
}
33+
else
34+
{
35+
- char buf[50];
36+
+ char buf[MAX_INSN_WIDTH + 1];
37+
unsigned int bpc = 0;
38+
unsigned int pb = 0;
39+
40+
@@ -6070,8 +6071,9 @@ main (int argc, char **argv)
41+
break;
42+
case OPTION_INSN_WIDTH:
43+
insn_width = strtoul (optarg, NULL, 0);
44+
- if (insn_width <= 0)
45+
- fatal (_("error: instruction width must be positive"));
46+
+ if (insn_width - 1 >= MAX_INSN_WIDTH)
47+
+ fatal (_("error: instruction width must be in the range 1 to "
48+
+ XSTRING (MAX_INSN_WIDTH)));
49+
break;
50+
case OPTION_INLINES:
51+
unwind_inlines = true;
52+
--
53+
2.43.7

0 commit comments

Comments
 (0)