From a367928942411b36a0b0bbb95055d01548430e8e Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Sat, 31 Aug 2019 13:08:36 -0700 Subject: binutils: Security fix for CVE-2019-14444 Source: git://sourceware.org / binutils-gdb.git MR: 99255 Type: Security Fix Disposition: Backport from https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e17869db99195849826eaaf5d2d0eb2cfdd7a2a7 ChangeID: 67ad4ab1ec34b941bdcfbb4f55d16176bbbd3d72 Description: Affects: <= 2.32.0 Fixes CVE-2019-14444 Signed-off-by: Armin Kuster --- meta/recipes-devtools/binutils/binutils-2.31.inc | 1 + .../binutils/binutils/CVE-2019-14444.patch | 33 ++++++++++++++++++++++ 2 files changed, 34 insertions(+) create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2019-14444.patch diff --git a/meta/recipes-devtools/binutils/binutils-2.31.inc b/meta/recipes-devtools/binutils/binutils-2.31.inc index 62acec500e..247f779a79 100644 --- a/meta/recipes-devtools/binutils/binutils-2.31.inc +++ b/meta/recipes-devtools/binutils/binutils-2.31.inc @@ -46,6 +46,7 @@ SRC_URI = "\ file://CVE-2018-18605.patch \ file://CVE-2018-18606.patch \ file://CVE-2018-18607.patch \ + file://CVE-2019-14444.patch \ " S = "${WORKDIR}/git" diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2019-14444.patch b/meta/recipes-devtools/binutils/binutils/CVE-2019-14444.patch new file mode 100644 index 0000000000..499cf0e046 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2019-14444.patch @@ -0,0 +1,33 @@ +From e17869db99195849826eaaf5d2d0eb2cfdd7a2a7 Mon Sep 17 00:00:00 2001 +From: Nick Clifton +Date: Mon, 5 Aug 2019 10:40:35 +0100 +Subject: [PATCH] Catch potential integer overflow in readelf when processing + corrupt binaries. + + PR 24829 + * readelf.c (apply_relocations): Catch potential integer overflow + whilst checking reloc location against section size. + +Upstream-Status: Backport +https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e17869db99195849826eaaf5d2d0eb2cfdd7a2a7 +CVE: CVE-2019-14444 +Dropped changelog +Signed-off-by: Armin Kuster + +--- + binutils/readelf.c | 2 +- + 2 files changed, 7 insertions(+), 1 deletion(-) + +Index: git/binutils/readelf.c +=================================================================== +--- git.orig/binutils/readelf.c ++++ git/binutils/readelf.c +@@ -13113,7 +13113,7 @@ apply_relocations (Filedata * + } + + rloc = start + rp->r_offset; +- if ((rloc + reloc_size) > end || (rloc < start)) ++ if (rloc >= end || (rloc + reloc_size) > end || (rloc < start)) + { + warn (_("skipping invalid relocation offset 0x%lx in section %s\n"), + (unsigned long) rp->r_offset, -- cgit 1.2.3-korg