From 1926240b0fb3967a5c52e9caf6dfb4fc2e66cb23 Mon Sep 17 00:00:00 2001 From: Thiruvadi Rajaraman Date: Wed, 20 Sep 2017 13:22:09 +0530 Subject: binutils: CVE-2017-8394 Source: git://sourceware.org/git/binutils-gdb.git MR: 74166 Type: Security Fix Disposition: Backport from binutils-2_29 ChangeID: d614742d33a55da6cafede60cd171766afb0aa1d Description: PR 21414, null pointer deref of _bfd_elf_large_com_section sym PR 21414 * section.c (GLOBAL_SYM_INIT): Make available in bfd.h. * elf.c (lcomm_sym): New. (_bfd_elf_large_com_section): Use lcomm_sym section symbol. * bfd-in2.h: Regenerate. Affects: <= 2.29 Author: Alan Modra Signed-off-by: Thiruvadi Rajaraman Reviewed-by: Armin Kuster Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster --- meta/recipes-devtools/binutils/binutils-2.27.inc | 2 + .../binutils/binutils/CVE-2017-8394.patch | 114 +++++++++++++++++++++ .../binutils/binutils/CVE-2017-8394_1.patch | 80 +++++++++++++++ 3 files changed, 196 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.27.inc b/meta/recipes-devtools/binutils/binutils-2.27.inc index 3e514fc042..a455b0192c 100644 --- a/meta/recipes-devtools/binutils/binutils-2.27.inc +++ b/meta/recipes-devtools/binutils/binutils-2.27.inc @@ -73,6 +73,8 @@ SRC_URI = "\ file://CVE-2017-7300.patch \ file://CVE-2017-8396.patch \ file://CVE-2017-8421.patch \ + file://CVE-2017-8394_1.patch \ + file://CVE-2017-8394.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch new file mode 100644 index 0000000000..14ee1910f4 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394.patch @@ -0,0 +1,114 @@ +commit 7eacd66b086cabb1daab20890d5481894d4f56b2 +Author: Alan Modra +Date: Sun Apr 23 15:21:11 2017 +0930 + + PR 21414, null pointer deref of _bfd_elf_large_com_section sym + + PR 21414 + * section.c (GLOBAL_SYM_INIT): Make available in bfd.h. + * elf.c (lcomm_sym): New. + (_bfd_elf_large_com_section): Use lcomm_sym section symbol. + * bfd-in2.h: Regenerate. + +Upstream-Status: Backport + +CVE: CVE-2017-8394 +Signed-off-by: Thiruvadi Rajaraman + +Index: git/bfd/bfd-in2.h +=================================================================== +--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:44.847475928 +0530 ++++ git/bfd/bfd-in2.h 2017-09-20 12:54:44.903476171 +0530 +@@ -1805,6 +1805,18 @@ + { NULL }, { NULL } \ + } + ++/* We use a macro to initialize the static asymbol structures because ++ traditional C does not permit us to initialize a union member while ++ gcc warns if we don't initialize it. ++ the_bfd, name, value, attr, section [, udata] */ ++#ifdef __STDC__ ++#define GLOBAL_SYM_INIT(NAME, SECTION) \ ++ { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }} ++#else ++#define GLOBAL_SYM_INIT(NAME, SECTION) \ ++ { 0, NAME, 0, BSF_SECTION_SYM, SECTION } ++#endif ++ + void bfd_section_list_clear (bfd *); + + asection *bfd_get_section_by_name (bfd *abfd, const char *name); +Index: git/bfd/section.c +=================================================================== +--- git.orig/bfd/section.c 2017-09-20 12:54:44.847475928 +0530 ++++ git/bfd/section.c 2017-09-20 12:54:44.903476171 +0530 +@@ -738,20 +738,20 @@ + . { NULL }, { NULL } \ + . } + . ++.{* We use a macro to initialize the static asymbol structures because ++. traditional C does not permit us to initialize a union member while ++. gcc warns if we don't initialize it. ++. the_bfd, name, value, attr, section [, udata] *} ++.#ifdef __STDC__ ++.#define GLOBAL_SYM_INIT(NAME, SECTION) \ ++. { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }} ++.#else ++.#define GLOBAL_SYM_INIT(NAME, SECTION) \ ++. { 0, NAME, 0, BSF_SECTION_SYM, SECTION } ++.#endif ++. + */ + +-/* We use a macro to initialize the static asymbol structures because +- traditional C does not permit us to initialize a union member while +- gcc warns if we don't initialize it. */ +- /* the_bfd, name, value, attr, section [, udata] */ +-#ifdef __STDC__ +-#define GLOBAL_SYM_INIT(NAME, SECTION) \ +- { 0, NAME, 0, BSF_SECTION_SYM, SECTION, { 0 }} +-#else +-#define GLOBAL_SYM_INIT(NAME, SECTION) \ +- { 0, NAME, 0, BSF_SECTION_SYM, SECTION } +-#endif +- + /* These symbols are global, not specific to any BFD. Therefore, anything + that tries to change them is broken, and should be repaired. */ + +Index: git/bfd/ChangeLog +=================================================================== +--- git.orig/bfd/ChangeLog 2017-09-20 12:54:44.735475444 +0530 ++++ git/bfd/ChangeLog 2017-09-20 12:54:44.903476171 +0530 +@@ -102,6 +102,14 @@ + * readelf.c (process_mips_specific): Remove null GOT data check. + + 2017-04-23 Alan Modra ++ ++ PR 21414 ++ * section.c (GLOBAL_SYM_INIT): Make available in bfd.h. ++ * elf.c (lcomm_sym): New. ++ (_bfd_elf_large_com_section): Use lcomm_sym section symbol. ++ * bfd-in2.h: Regenerate. ++ ++2017-04-23 Alan Modra + + PR 21412 + * elf-bfd.h (struct elf_backend_data ): Change +Index: git/bfd/elf.c +=================================================================== +--- git.orig/bfd/elf.c 2017-09-20 12:54:44.847475928 +0530 ++++ git/bfd/elf.c 2017-09-20 13:00:22.636091768 +0530 +@@ -10986,9 +10986,11 @@ + + /* It is only used by x86-64 so far. + ??? This repeats *COM* id of zero. sec->id is supposed to be unique, +- but current usage would allow all of _bfd_std_section to be zero. t*/ ++ but current usage would allow all of _bfd_std_section to be zero. */ ++static const asymbol lcomm_sym ++ = GLOBAL_SYM_INIT ("LARGE_COMMON", &_bfd_elf_large_com_section); + asection _bfd_elf_large_com_section +- = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL, ++ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, &lcomm_sym, + "LARGE_COMMON", 0, SEC_IS_COMMON); + + void diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch new file mode 100644 index 0000000000..e1dfd8bb40 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2017-8394_1.patch @@ -0,0 +1,80 @@ +commit 821e6ff6299aa39e841ca50e1ae8a98e3554fd5f +Author: Alan Modra +Date: Wed Oct 12 09:41:33 2016 +1030 + + BFD_FAKE_SECTION macro params + + Order NAME, IDX, FLAGS as per STD_SECTION macro. + + * section.c (BFD_FAKE_SECTION): Reorder parameters. Formatting. + (STD_SECTION): Adjust to suit. + * elf.c (_bfd_elf_large_com_section): Likewise. + * bfd-in2.h: Regenerate. + +Upstream-Status: Backport + +CVE: CVE-2017-8394 +Signed-off-by: Thiruvadi Rajaraman + + +Index: git/bfd/bfd-in2.h +=================================================================== +--- git.orig/bfd/bfd-in2.h 2017-09-20 12:54:42.423465338 +0530 ++++ git/bfd/bfd-in2.h 2017-09-20 13:02:48.000000000 +0530 +@@ -1767,9 +1767,9 @@ + #define bfd_section_removed_from_list(ABFD, S) \ + ((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S)) + +-#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \ ++#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \ + /* name, id, index, next, prev, flags, user_set_vma, */ \ +- { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \ ++ { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \ + \ + /* linker_mark, linker_has_input, gc_mark, decompress_status, */ \ + 0, 0, 1, 0, \ +Index: git/bfd/elf.c +=================================================================== +--- git.orig/bfd/elf.c 2017-09-20 12:54:44.503474440 +0530 ++++ git/bfd/elf.c 2017-09-20 13:02:48.000000000 +0530 +@@ -10984,10 +10984,12 @@ + return n; + } + +-/* It is only used by x86-64 so far. */ ++/* It is only used by x86-64 so far. ++ ??? This repeats *COM* id of zero. sec->id is supposed to be unique, ++ but current usage would allow all of _bfd_std_section to be zero. t*/ + asection _bfd_elf_large_com_section +- = BFD_FAKE_SECTION (_bfd_elf_large_com_section, +- SEC_IS_COMMON, NULL, "LARGE_COMMON", 0); ++ = BFD_FAKE_SECTION (_bfd_elf_large_com_section, NULL, ++ "LARGE_COMMON", 0, SEC_IS_COMMON); + + void + _bfd_elf_post_process_headers (bfd * abfd, +Index: git/bfd/section.c +=================================================================== +--- git.orig/bfd/section.c 2017-09-20 12:54:43.815471454 +0530 ++++ git/bfd/section.c 2017-09-20 13:02:48.000000000 +0530 +@@ -700,9 +700,9 @@ + .#define bfd_section_removed_from_list(ABFD, S) \ + . ((S)->next == NULL ? (ABFD)->section_last != (S) : (S)->next->prev != (S)) + . +-.#define BFD_FAKE_SECTION(SEC, FLAGS, SYM, NAME, IDX) \ ++.#define BFD_FAKE_SECTION(SEC, SYM, NAME, IDX, FLAGS) \ + . {* name, id, index, next, prev, flags, user_set_vma, *} \ +-. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \ ++. { NAME, IDX, 0, NULL, NULL, FLAGS, 0, \ + . \ + . {* linker_mark, linker_has_input, gc_mark, decompress_status, *} \ + . 0, 0, 1, 0, \ +@@ -764,7 +764,7 @@ + }; + + #define STD_SECTION(NAME, IDX, FLAGS) \ +- BFD_FAKE_SECTION(_bfd_std_section[IDX], FLAGS, &global_syms[IDX], NAME, IDX) ++ BFD_FAKE_SECTION(_bfd_std_section[IDX], &global_syms[IDX], NAME, IDX, FLAGS) + + asection _bfd_std_section[] = { + STD_SECTION (BFD_COM_SECTION_NAME, 0, SEC_IS_COMMON), -- cgit 1.2.3-korg