From: Peter Marko Date: Mon, 20 Oct 2025 22:09:11 +0000 (+0200) Subject: binutils: patch CVE-2025-11495 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d3ec5a470bba069dee809780a5c892c7d52e05ac;p=thirdparty%2Fopenembedded%2Fopenembedded-core.git binutils: patch CVE-2025-11495 Pick commit per NVD CVE report. Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie --- diff --git a/meta/recipes-devtools/binutils/binutils-2.45.inc b/meta/recipes-devtools/binutils/binutils-2.45.inc index 62b5bf6c26..288475ac39 100644 --- a/meta/recipes-devtools/binutils/binutils-2.45.inc +++ b/meta/recipes-devtools/binutils/binutils-2.45.inc @@ -42,4 +42,5 @@ SRC_URI = "\ file://CVE-2025-11414.patch \ file://CVE-2025-11412.patch \ file://CVE-2025-11413.patch \ + file://CVE-2025-11495.patch \ " diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-11495.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-11495.patch new file mode 100644 index 0000000000..6e5e68fe27 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-11495.patch @@ -0,0 +1,153 @@ +From 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 Mon Sep 17 00:00:00 2001 +From: "H.J. Lu" +Date: Tue, 30 Sep 2025 08:18:29 +0800 +Subject: [PATCH] x86: Disallow TLS relocation in non executable section + +Since TLS relocations are applied to executable machine instructions, +disallow TLS relocation in non-SHT_PROGBITS, non-SHF_EXECINSTR section. + + PR ld/33451 + PR ld/33502 + * elf32-i386.c (elf_i386_tls_transition): Disallow TLS relocation + in non-SHT_PROGBITS, non-SHF_EXECINSTR section. + (elf_i386_scan_relocs): Likewise. + * elf64-x86-64.c (elf_x86_64_tls_transition): Likewise. + (elf_x86_64_scan_relocs): Likewise. + * elfxx-x86.c (_bfd_x86_elf_link_report_tls_invalid_section_error): + New. + * elfxx-x86.h (_bfd_x86_elf_link_report_tls_invalid_section_error): + Likewise. + +Signed-off-by: H.J. Lu + +CVE: CVE-2025-11495 +Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0] +Signed-off-by: Peter Marko +--- + bfd/elf32-i386.c | 19 +++++++++++++++++++ + bfd/elf64-x86-64.c | 20 ++++++++++++++++++++ + bfd/elfxx-x86.c | 20 ++++++++++++++++++++ + bfd/elfxx-x86.h | 4 ++++ + 4 files changed, 63 insertions(+) + +diff --git a/bfd/elf32-i386.c b/bfd/elf32-i386.c +index 507a0762aff..0d60eded701 100644 +--- a/bfd/elf32-i386.c ++++ b/bfd/elf32-i386.c +@@ -1166,6 +1166,15 @@ elf_i386_tls_transition (struct bfd_link_info *info, bfd *abfd, + return true; + } + ++ if ((elf_section_type (sec) != SHT_PROGBITS ++ || (sec->flags & SEC_CODE) == 0)) ++ { ++ reloc_howto_type *howto = elf_i386_rtype_to_howto (from_type); ++ _bfd_x86_elf_link_report_tls_invalid_section_error ++ (abfd, sec, symtab_hdr, h, sym, howto); ++ return false; ++ } ++ + /* Return TRUE if there is no transition. */ + if (from_type == to_type) + return true; +@@ -1727,6 +1736,16 @@ elf_i386_scan_relocs (bfd *abfd, + tls_type = GOT_TLS_IE_POS; break; + } + ++ if (tls_type >= GOT_TLS_GD ++ && tls_type <= GOT_TLS_GDESC ++ && (elf_section_type (sec) != SHT_PROGBITS ++ || (sec->flags & SEC_CODE) == 0)) ++ { ++ _bfd_x86_elf_link_report_tls_invalid_section_error ++ (abfd, sec, symtab_hdr, h, isym, howto); ++ goto error_return; ++ } ++ + if (h != NULL) + { + h->got.refcount = 1; +diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c +index 620b6a380cd..59b43149897 100644 +--- a/bfd/elf64-x86-64.c ++++ b/bfd/elf64-x86-64.c +@@ -1626,6 +1626,16 @@ elf_x86_64_tls_transition (struct bfd_link_info *info, bfd *abfd, + return true; + } + ++ if ((elf_section_type (sec) != SHT_PROGBITS ++ || (sec->flags & SEC_CODE) == 0)) ++ { ++ reloc_howto_type *howto = elf_x86_64_rtype_to_howto (abfd, ++ from_type); ++ _bfd_x86_elf_link_report_tls_invalid_section_error ++ (abfd, sec, symtab_hdr, h, sym, howto); ++ return false; ++ } ++ + /* Return TRUE if there is no transition. */ + if (from_type == to_type + || (from_type == R_X86_64_CODE_4_GOTTPOFF +@@ -2748,6 +2758,16 @@ elf_x86_64_scan_relocs (bfd *abfd, struct bfd_link_info *info, + break; + } + ++ if (tls_type >= GOT_TLS_GD ++ && tls_type <= GOT_TLS_GDESC ++ && (elf_section_type (sec) != SHT_PROGBITS ++ || (sec->flags & SEC_CODE) == 0)) ++ { ++ _bfd_x86_elf_link_report_tls_invalid_section_error ++ (abfd, sec, symtab_hdr, h, isym, howto); ++ goto error_return; ++ } ++ + if (h != NULL) + { + h->got.refcount = 1; +diff --git a/bfd/elfxx-x86.c b/bfd/elfxx-x86.c +index 0d389968c91..d8c653a9ad2 100644 +--- a/bfd/elfxx-x86.c ++++ b/bfd/elfxx-x86.c +@@ -3348,6 +3348,26 @@ _bfd_x86_elf_link_report_tls_transition_error + bfd_set_error (bfd_error_bad_value); + } + ++/* Report TLS invalid section error. */ ++ ++void ++_bfd_x86_elf_link_report_tls_invalid_section_error ++ (bfd *abfd, asection *sec, Elf_Internal_Shdr *symtab_hdr, ++ struct elf_link_hash_entry *h, Elf_Internal_Sym *sym, ++ reloc_howto_type *howto) ++{ ++ const char *name; ++ if (h) ++ name = h->root.root.string; ++ else ++ name = bfd_elf_sym_name (abfd, symtab_hdr, sym, NULL); ++ _bfd_error_handler ++ /* xgettext:c-format */ ++ (_("%pB: relocation %s against thread local symbol `%s' in " ++ "invalid section `%pA'"), abfd, howto->name, name, sec); ++ bfd_set_error (bfd_error_bad_value); ++} ++ + /* Return TRUE if symbol should be hashed in the `.gnu.hash' section. */ + + bool +diff --git a/bfd/elfxx-x86.h b/bfd/elfxx-x86.h +index 1ebc9d2f2e5..f8a24a77577 100644 +--- a/bfd/elfxx-x86.h ++++ b/bfd/elfxx-x86.h +@@ -939,6 +939,10 @@ extern void _bfd_x86_elf_link_report_tls_transition_error + const Elf_Internal_Rela *, const char *, const char *, + enum elf_x86_tls_error_type); + ++extern void _bfd_x86_elf_link_report_tls_invalid_section_error ++ (bfd *, asection *, Elf_Internal_Shdr *, struct elf_link_hash_entry *, ++ Elf_Internal_Sym *, reloc_howto_type *); ++ + #define bfd_elf64_mkobject \ + _bfd_x86_elf_mkobject + #define bfd_elf32_mkobject \