From 4dc951f3eed55617991ba8cd9337fdf5f3d5f1f5 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Mon, 19 May 2025 16:00:42 +0200 Subject: [PATCH] package/binutils: apply security patch for CVE-2025-3198 This fixes a memory leaks that affects both binutils 2.43 and 2.44, see https://www.cve.org/CVERecord?id=CVE-2025-3198 Fixes the following CVE: - CVE-2025-3198: A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. Signed-off-by: Titouan Christophe Signed-off-by: Julien Olivain --- .../2.43.1/0003-objdump-memleak.patch | 31 +++++++++++++++++++ .../binutils/2.44/0003-objdump-memleak.patch | 31 +++++++++++++++++++ package/binutils/binutils.mk | 3 ++ 3 files changed, 65 insertions(+) create mode 100644 package/binutils/2.43.1/0003-objdump-memleak.patch create mode 100644 package/binutils/2.44/0003-objdump-memleak.patch diff --git a/package/binutils/2.43.1/0003-objdump-memleak.patch b/package/binutils/2.43.1/0003-objdump-memleak.patch new file mode 100644 index 0000000000..1b1632093d --- /dev/null +++ b/package/binutils/2.43.1/0003-objdump-memleak.patch @@ -0,0 +1,31 @@ +From ba6ad3a18cb26b79e0e3b84c39f707535bbc344d Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Wed, 19 Feb 2025 07:58:54 +1030 +Subject: [PATCH] PR32716, objdump -i memory leak + +PR binutils/32716 +* bucomm.c (display_info): Free arg.info. + +Upstream: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d + +CVE: CVE-2025-3198 +Signed-off-by: Titouan Christophe +--- + binutils/bucomm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/binutils/bucomm.c b/binutils/bucomm.c +index ccf54099154..d4554737db1 100644 +--- a/binutils/bucomm.c ++++ b/binutils/bucomm.c +@@ -435,6 +435,7 @@ display_info (void) + if (!arg.error) + display_target_tables (&arg); + ++ free (arg.info); + return arg.error; + } + +-- +2.43.5 + diff --git a/package/binutils/2.44/0003-objdump-memleak.patch b/package/binutils/2.44/0003-objdump-memleak.patch new file mode 100644 index 0000000000..1b1632093d --- /dev/null +++ b/package/binutils/2.44/0003-objdump-memleak.patch @@ -0,0 +1,31 @@ +From ba6ad3a18cb26b79e0e3b84c39f707535bbc344d Mon Sep 17 00:00:00 2001 +From: Alan Modra +Date: Wed, 19 Feb 2025 07:58:54 +1030 +Subject: [PATCH] PR32716, objdump -i memory leak + +PR binutils/32716 +* bucomm.c (display_info): Free arg.info. + +Upstream: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ba6ad3a18cb26b79e0e3b84c39f707535bbc344d + +CVE: CVE-2025-3198 +Signed-off-by: Titouan Christophe +--- + binutils/bucomm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/binutils/bucomm.c b/binutils/bucomm.c +index ccf54099154..d4554737db1 100644 +--- a/binutils/bucomm.c ++++ b/binutils/bucomm.c +@@ -435,6 +435,7 @@ display_info (void) + if (!arg.error) + display_target_tables (&arg); + ++ free (arg.info); + return arg.error; + } + +-- +2.43.5 + diff --git a/package/binutils/binutils.mk b/package/binutils/binutils.mk index fd6fc3de8d..2b5064d739 100644 --- a/package/binutils/binutils.mk +++ b/package/binutils/binutils.mk @@ -31,6 +31,9 @@ BINUTILS_LICENSE = GPL-3.0+, libiberty LGPL-2.1+ BINUTILS_LICENSE_FILES = COPYING3 COPYING.LIB BINUTILS_CPE_ID_VENDOR = gnu +# 0003-objdump-memleak.patch +BINUTILS_IGNORE_CVES += CVE-2025-3198 + ifeq ($(BINUTILS_FROM_GIT),y) BINUTILS_DEPENDENCIES += host-flex host-bison HOST_BINUTILS_DEPENDENCIES += host-flex host-bison