[AutoPR- Security] Patch gdb for CVE-2025-1178, CVE-2025-1176 [MEDIUM]#17354
Open
azurelinux-security wants to merge 2 commits into
Open
[AutoPR- Security] Patch gdb for CVE-2025-1178, CVE-2025-1176 [MEDIUM]#17354azurelinux-security wants to merge 2 commits into
azurelinux-security wants to merge 2 commits into
Conversation
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
Contributor
|
Confirmed affected by verifying bfd/elf64-x86-64.c is compiled during the build Patch verified to be in sync with the upstream fix. 
|
azurelinux-security
changed the title
Contributor
Author
🔒 CVE Patch Review: CVE-2025-1176, CVE-2025-1178PR #17354 — [AutoPR- Security] Patch gdb for CVE-2025-1178, CVE-2025-1176 [MEDIUM] Spec File Validation
Build Verification
🤖 AI Build Log Analysis
🧪 Test Log Analysis
🤖 AI Test Log Analysis
Patch Analysis
Detailed analysisComparison shows the PR implements the same core change as upstream commit f9978def: it adds a static helper get_ext_sym_hash(cookie, r_symndx) that returns NULL unless the symbol is non-local (or out of local range) and r_symndx >= cookie->extsymoff, thereby guarding the sym_hashes index, and follows indirect/warning links. Then it updates three functions to use this helper:
The PR’s file indices and context line numbers differ (fc3edef..afafbbb vs upstream a31e4092a16..1f1263007c0), indicating an older base, and placement of the new helper appears earlier in the file (around where struct elf_find_verdep_info is present) rather than the exact upstream surrounding context. These are expected for a backport and do not affect semantics; the helper is defined before its uses, so no prototype issues arise. The guard condition in get_ext_sym_hash, the while-loop dereferencing of indirect/warning hash entries, and all downstream behavior are identical to upstream. The PR also removes the explicit corrupt-input einfo() branch in _bfd_elf_gc_mark_rsec, matching upstream’s change. No upstream hunks are missing: all three modified regions are present with equivalent logic and the same net 45 insertions/45 deletions. Given the faithful replication of guard logic and usage, the risk of incompleteness or regression beyond what upstream accepted is low. As with any backport, minor context differences exist, but they are limited to surrounding code layout and do not alter the fix’s behavior.
Raw diff (upstream vs PR)--- upstream
+++ pr
@@ -1,156 +1,165 @@
-From f9978defb6fab0bd8583942d97c112b0932ac814 Mon Sep 17 00:00:00 2001
-From: Nick Clifton <nickc@redhat.com>
-Date: Wed, 5 Feb 2025 11:15:11 +0000
-Subject: [PATCH] Prevent illegal memory access when indexing into the
- sym_hashes array of the elf bfd cookie structure.
-
-PR 32636
----
- bfd/elflink.c | 90 +++++++++++++++++++++++++--------------------------
- 1 file changed, 45 insertions(+), 45 deletions(-)
-
-diff --git a/bfd/elflink.c b/bfd/elflink.c
-index a31e4092a16..1f1263007c0 100644
---- a/bfd/elflink.c
-+++ b/bfd/elflink.c
-@@ -96,22 +96,37 @@ _bfd_elf_link_keep_memory (struct bfd_link_info *info)
- return true;
- }
-
--asection *
--_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
-- unsigned long r_symndx,
-- bool discard)
-+static struct elf_link_hash_entry *
-+get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
- {
-- if (r_symndx >= cookie->locsymcount
-- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
-- {
-- struct elf_link_hash_entry *h;
-+ struct elf_link_hash_entry *h = NULL;
-
-+ if ((r_symndx >= cookie->locsymcount
-+ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
-+ /* Guard against corrupt input. See PR 32636 for an example. */
-+ && r_symndx >= cookie->extsymoff)
-+ {
- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
-
- while (h->root.type == bfd_link_hash_indirect
- || h->root.type == bfd_link_hash_warning)
- h = (struct elf_link_hash_entry *) h->root.u.i.link;
-+ }
+diff --git a/SPECS/gdb/CVE-2025-1176.patch b/SPECS/gdb/CVE-2025-1176.patch
+new file mode 100644
+index 00000000000..47a5e59035b
+--- /dev/null
++++ b/SPECS/gdb/CVE-2025-1176.patch
+@@ -0,0 +1,159 @@
++From 762fa3949f284e522629846fd9824cd9368dbb75 Mon Sep 17 00:00:00 2001
++From: Nick Clifton <nickc@redhat.com>
++Date: Wed, 5 Feb 2025 11:15:11 +0000
++Subject: [PATCH] Prevent illegal memory access when indexing into the
++ sym_hashes array of the elf bfd cookie structure.
+
-+ return h;
-+}
-
-+asection *
-+_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
-+ unsigned long r_symndx,
-+ bool discard)
-+{
-+ struct elf_link_hash_entry *h;
++PR 32636
+
-+ h = get_ext_sym_hash (cookie, r_symndx);
-+
-+ if (h != NULL)
-+ {
- if ((h->root.type == bfd_link_hash_defined
- || h->root.type == bfd_link_hash_defweak)
- && discarded_section (h->root.u.def.section))
-@@ -119,21 +134,20 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
- else
- return NULL;
- }
-- else
-- {
-- /* It's not a relocation against a global symbol,
-- but it could be a relocation against a local
-- symbol for a discarded section. */
-- asection *isec;
-- Elf_Internal_Sym *isym;
-
-- /* Need to: get the symbol; get the section. */
-- isym = &cookie->locsyms[r_symndx];
-- isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
-- if (isec != NULL
-- && discard ? discarded_section (isec) : 1)
-- return isec;
-- }
-+ /* It's not a relocation against a global symbol,
-+ but it could be a relocation against a local
-+ symbol for a discarded section. */
-+ asection *isec;
-+ Elf_Internal_Sym *isym;
++Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
++Upstream-reference: https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814
++---
++ bfd/elflink.c | 90 +++++++++++++++++++++++++--------------------------
++ 1 file changed, 45 insertions(+), 45 deletions(-)
+
-+ /* Need to: get the symbol; get the section. */
-+ isym = &cookie->locsyms[r_symndx];
-+ isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
-+ if (isec != NULL
-+ && discard ? discarded_section (isec) : 1)
-+ return isec;
++diff --git a/bfd/elflink.c b/bfd/elflink.c
++index fc3edef..afafbbb 100644
++--- a/bfd/elflink.c
+++++ b/bfd/elflink.c
++@@ -62,22 +62,37 @@ struct elf_find_verdep_info
++ static bool _bfd_elf_fix_symbol_flags
++ (struct elf_link_hash_entry *, struct elf_info_failed *);
++
++-asection *
++-_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
++- unsigned long r_symndx,
++- bool discard)
+++static struct elf_link_hash_entry *
+++get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx)
++ {
++- if (r_symndx >= cookie->locsymcount
++- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
++- {
++- struct elf_link_hash_entry *h;
+++ struct elf_link_hash_entry *h = NULL;
++
+++ if ((r_symndx >= cookie->locsymcount
+++ || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
+++ /* Guard against corrupt input. See PR 32636 for an example. */
+++ && r_symndx >= cookie->extsymoff)
+++ {
++ h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
++
++ while (h->root.type == bfd_link_hash_indirect
++ || h->root.type == bfd_link_hash_warning)
++ h = (struct elf_link_hash_entry *) h->root.u.i.link;
+++ }
+++
+++ return h;
+++}
++
+++asection *
+++_bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
+++ unsigned long r_symndx,
+++ bool discard)
+++{
+++ struct elf_link_hash_entry *h;
+++
+++ h = get_ext_sym_hash (cookie, r_symndx);
+++
+++ if (h != NULL)
+++ {
++ if ((h->root.type == bfd_link_hash_defined
++ || h->root.type == bfd_link_hash_defweak)
++ && discarded_section (h->root.u.def.section))
++@@ -85,21 +100,20 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie,
++ else
++ return NULL;
++ }
++- else
++- {
++- /* It's not a relocation against a global symbol,
++- but it could be a relocation against a local
++- symbol for a discarded section. */
++- asection *isec;
++- Elf_Internal_Sym *isym;
++
++- /* Need to: get the symbol; get the section. */
++- isym = &cookie->locsyms[r_symndx];
++- isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
++- if (isec != NULL
++- && discard ? discarded_section (isec) : 1)
++- return isec;
++- }
+++ /* It's not a relocation against a global symbol,
+++ but it could be a relocation against a local
+++ symbol for a discarded section. */
+++ asection *isec;
+++ Elf_Internal_Sym *isym;
+++
+++ /* Need to: get the symbol; get the section. */
+++ isym = &cookie->locsyms[r_symndx];
+++ isec = bfd_section_from_elf_index (cookie->abfd, isym->st_shndx);
+++ if (isec != NULL
+++ && discard ? discarded_section (isec) : 1)
+++ return isec;
+++
++ return NULL;
++ }
++
++@@ -13707,22 +13721,12 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
++ if (r_symndx == STN_UNDEF)
++ return NULL;
++
++- if (r_symndx >= cookie->locsymcount
++- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
+++ h = get_ext_sym_hash (cookie, r_symndx);
+++
+++ if (h != NULL)
++ {
++ bool was_marked;
++
++- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
++- if (h == NULL)
++- {
++- info->callbacks->einfo (_("%F%P: corrupt input: %pB\n"),
++- sec->owner);
++- return NULL;
++- }
++- while (h->root.type == bfd_link_hash_indirect
++- || h->root.type == bfd_link_hash_warning)
++- h = (struct elf_link_hash_entry *) h->root.u.i.link;
++-
++ was_marked = h->mark;
++ h->mark = 1;
++ /* Keep all aliases of the symbol too. If an object symbol
++@@ -14768,17 +14772,12 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
++ if (r_symndx == STN_UNDEF)
++ return true;
++
++- if (r_symndx >= rcookie->locsymcount
++- || ELF_ST_BIND (rcookie->locsyms[r_symndx].st_info) != STB_LOCAL)
++- {
++- struct elf_link_hash_entry *h;
++-
++- h = rcookie->sym_hashes[r_symndx - rcookie->extsymoff];
++-
++- while (h->root.type == bfd_link_hash_indirect
++- || h->root.type == bfd_link_hash_warning)
++- h = (struct elf_link_hash_entry *) h->root.u.i.link;
+++ struct elf_link_hash_entry *h;
++
+++ h = get_ext_sym_hash (rcookie, r_symndx);
+++
+++ if (h != NULL)
+++ {
++ if ((h->root.type == bfd_link_hash_defined
++ || h->root.type == bfd_link_hash_defweak)
++ && (h->root.u.def.section->owner != rcookie->abfd
++@@ -14802,6 +14801,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
++ || discarded_section (isec)))
++ return true;
++ }
+++
++ return false;
++ }
++ return false;
++--
++2.45.4
+
- return NULL;
- }
-
-@@ -13997,22 +14011,12 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec,
- if (r_symndx == STN_UNDEF)
- return NULL;
-
-- if (r_symndx >= cookie->locsymcount
-- || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL)
-+ h = get_ext_sym_hash (cookie, r_symndx);
-+
-+ if (h != NULL)
- {
- bool was_marked;
-
-- h = cookie->sym_hashes[r_symndx - cookie->extsymoff];
-- if (h == NULL)
-- {
-- info->callbacks->einfo (_("%F%P: corrupt input: %pB\n"),
-- sec->owner);
-- return NULL;
-- }
-- while (h->root.type == bfd_link_hash_indirect
-- || h->root.type == bfd_link_hash_warning)
-- h = (struct elf_link_hash_entry *) h->root.u.i.link;
--
- was_marked = h->mark;
- h->mark = 1;
- /* Keep all aliases of the symbol too. If an object symbol
-@@ -15067,17 +15071,12 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
- if (r_symndx == STN_UNDEF)
- return true;
-
-- if (r_symndx >= rcookie->locsymcount
-- || ELF_ST_BIND (rcookie->locsyms[r_symndx].st_info) != STB_LOCAL)
-- {
-- struct elf_link_hash_entry *h;
--
-- h = rcookie->sym_hashes[r_symndx - rcookie->extsymoff];
--
-- while (h->root.type == bfd_link_hash_indirect
-- || h->root.type == bfd_link_hash_warning)
-- h = (struct elf_link_hash_entry *) h->root.u.i.link;
-+ struct elf_link_hash_entry *h;
-
-+ h = get_ext_sym_hash (rcookie, r_symndx);
-+
-+ if (h != NULL)
-+ {
- if ((h->root.type == bfd_link_hash_defined
- || h->root.type == bfd_link_hash_defweak)
- && (h->root.u.def.section->owner != rcookie->abfd
-@@ -15101,6 +15100,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie)
- || discarded_section (isec)))
- return true;
- }
-+
- return false;
- }
- return false;
---
-2.43.7
-
--- upstream
+++ pr
@@ -1,34 +1,43 @@
-From 75086e9de1707281172cc77f178e7949a4414ed0 Mon Sep 17 00:00:00 2001
-From: Nick Clifton <nickc@redhat.com>
-Date: Wed, 5 Feb 2025 13:26:51 +0000
-Subject: [PATCH] Prevent an abort in the bfd linker when attempting to
- generate dynamic relocs for a corrupt input file.
-
-PR 32638
----
- bfd/elf64-x86-64.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
-index 61334c3ab04..32db254ba6c 100644
---- a/bfd/elf64-x86-64.c
-+++ b/bfd/elf64-x86-64.c
-@@ -5303,6 +5303,15 @@ elf_x86_64_finish_dynamic_symbol (bfd *output_bfd,
-
- if (generate_dynamic_reloc)
- {
-+ /* If the relgot section has not been created, then
-+ generate an error instead of a reloc. cf PR 32638. */
-+ if (relgot == NULL || relgot->size == 0)
-+ {
-+ info->callbacks->einfo (_("%F%pB: Unable to generate dynamic relocs because a suitable section does not exist\n"),
-+ output_bfd);
-+ return false;
-+ }
-+
- if (relative_reloc_name != NULL
- && htab->params->report_relative_reloc)
- _bfd_x86_elf_link_report_relative_reloc
---
-2.43.7
-
+diff --git a/SPECS/gdb/CVE-2025-1178.patch b/SPECS/gdb/CVE-2025-1178.patch
+new file mode 100644
+index 00000000000..bc62f2250f5
+--- /dev/null
++++ b/SPECS/gdb/CVE-2025-1178.patch
+@@ -0,0 +1,37 @@
++From f0e64304059decf627cee992330188eaf87761aa Mon Sep 17 00:00:00 2001
++From: Nick Clifton <nickc@redhat.com>
++Date: Wed, 5 Feb 2025 13:26:51 +0000
++Subject: [PATCH] Prevent an abort in the bfd linker when attempting to
++ generate dynamic relocs for a corrupt input file.
++
++PR 32638
++
++Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
++Upstream-reference: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75086e9de1707281172cc77f178e7949a4414ed0;a=patch;
++---
++ bfd/elf64-x86-64.c | 9 +++++++++
++ 1 file changed, 9 insertions(+)
++
++diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
++index 8cf733d..4fd5d01 100644
++--- a/bfd/elf64-x86-64.c
+++++ b/bfd/elf64-x86-64.c
++@@ -4646,6 +4646,15 @@ elf_x86_64_finish_dynamic_symbol (bfd *output_bfd,
++
++ if (generate_dynamic_reloc)
++ {
+++ /* If the relgot section has not been created, then
+++ generate an error instead of a reloc. cf PR 32638. */
+++ if (relgot == NULL || relgot->size == 0)
+++ {
+++ info->callbacks->einfo (_("%F%pB: Unable to generate dynamic relocs because a suitable section does not exist\n"),
+++ output_bfd);
+++ return false;
+++ }
+++
++ if (relative_reloc_name != NULL
++ && htab->params->report_relative_reloc)
++ _bfd_x86_elf_link_report_relative_reloc
++--
++2.45.4
++
Verdict❌ CHANGES REQUESTED — Please address the issues flagged above. |
Kanishk-Bansal
approved these changes
May 22, 2026
Contributor
Kanishk-Bansal
left a comment
Kanishk-Bansal
left a comment
There was a problem hiding this comment.
Patch Analysis (both the patch matches upstream; the AI test analysis can be ignored.)
- Buddy Build
- patch applied during the build (check
rpm.log) - patch include an upstream reference
- PR has security tag
Kanishk-Bansal
added
the
ready-for-stable-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto Patch gdb for CVE-2025-1178, CVE-2025-1176.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1121608&view=results
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1121992&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology