binutils: Security fix CVE-2018-8945

PATCH In review Armin Kuster 3 participants 14 messages Aug 6, 2018

lore

Share & tools

lore

Armin Kuster

author

2018-08-06 14:29 UTC #0 lore raw

PATCH 1/12 binutils: Security fix CVE-2018-8945

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-8945.patch          | 70 ++++++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-8945.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 9c883ac..349fa5a 100644
@@ -35,6 +35,7 @@ SRC_URI = "\
      file://0013-fix-the-incorrect-assembling-for-ppc-wait-mnemonic.patch \
      file://0014-Detect-64-bit-MIPS-targets.patch \
      file://0015-sync-with-OE-libtool-changes.patch \
+     file://CVE-2018-8945.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-8945.patch new file +70 -0

70 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #1 lore raw

PATCH 2/12 binutls: Security fix CVE-2018-7643

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |   1 +
 .../binutils/binutils/CVE-2018-7643.patch          | 102 +++++++++++++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-7643.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 349fa5a..1952d46 100644
@@ -36,6 +36,7 @@ SRC_URI = "\
      file://0014-Detect-64-bit-MIPS-targets.patch \
      file://0015-sync-with-OE-libtool-changes.patch \
      file://CVE-2018-8945.patch \
+     file://CVE-2018-7643.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-7643.patch new file +102 -0

102 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #2 lore raw

PATCH 3/12 binutls: Security fix CVE-2018-6872

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-6872.patch          | 50 ++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-6872.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 1952d46..23625d1 100644
@@ -37,6 +37,7 @@ SRC_URI = "\
      file://0015-sync-with-OE-libtool-changes.patch \
      file://CVE-2018-8945.patch \
      file://CVE-2018-7643.patch \
+     file://CVE-2018-6872.patch \ 
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-6872.patch new file +50 -0

50 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #3 lore raw

PATCH 4/12 binutls: Security fix CVE-2018-6759

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |   1 +
 .../binutils/binutils/CVE-2018-6759.patch          | 108 +++++++++++++++++++++
 2 files changed, 109 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-6759.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 23625d1..1621e5b 100644
@@ -38,6 +38,7 @@ SRC_URI = "\
      file://CVE-2018-8945.patch \
      file://CVE-2018-7643.patch \
      file://CVE-2018-6872.patch \ 
+     file://CVE-2018-6759.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-6759.patch new file +108 -0

108 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #4 lore raw

PATCH 5/12 binutls: Security fix CVE-2018-7642

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-7642.patch          | 51 ++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-7642.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 1621e5b..6b915fa 100644
@@ -39,6 +39,7 @@ SRC_URI = "\
      file://CVE-2018-7643.patch \
      file://CVE-2018-6872.patch \ 
      file://CVE-2018-6759.patch \
+     file://CVE-2018-7642.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-7642.patch new file +51 -0

51 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #5 lore raw

PATCH 6/12 binutls: Security fix CVE-2018-7208

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-7208.patch          | 47 ++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-7208.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 6b915fa..3a39d5f 100644
@@ -40,6 +40,7 @@ SRC_URI = "\
      file://CVE-2018-6872.patch \ 
      file://CVE-2018-6759.patch \
      file://CVE-2018-7642.patch \
+     file://CVE-2018-7208.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-7208.patch new file +47 -0

47 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #6 lore raw

PATCH 7/12 binutls: Security fix CVE-2018-7569

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |   1 +
 .../binutils/binutils/CVE-2018-7569.patch          | 119 +++++++++++++++++++++
 2 files changed, 120 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-7569.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 3a39d5f..32eb44e 100644
@@ -41,6 +41,7 @@ SRC_URI = "\
      file://CVE-2018-6759.patch \
      file://CVE-2018-7642.patch \
      file://CVE-2018-7208.patch \
+     file://CVE-2018-7569.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-7569.patch new file +119 -0

119 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #7 lore raw

PATCH 8/12 binutls: Security fix CVE-2018-7568

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-7568.patch          | 85 ++++++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-7568.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 32eb44e..8995715 100644
@@ -42,6 +42,7 @@ SRC_URI = "\
      file://CVE-2018-7642.patch \
      file://CVE-2018-7208.patch \
      file://CVE-2018-7569.patch \
+     file://CVE-2018-7568.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-7568.patch new file +85 -0

85 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #8 lore raw

PATCH 9/12 binutls: Security fix CVE-2018-10373

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-10373.patch         | 45 ++++++++++++++++++++++
 2 files changed, 46 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-10373.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 8995715..7b1705e 100644
@@ -43,6 +43,7 @@ SRC_URI = "\
      file://CVE-2018-7208.patch \
      file://CVE-2018-7569.patch \
      file://CVE-2018-7568.patch \
+     file://CVE-2018-10373.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-10373.patch new file +45 -0

45 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #9 lore raw

PATCH 10/12 binutls: Security fix CVE-2018-10372

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-10372.patch         | 58 ++++++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-10372.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 7b1705e..8693757 100644
@@ -44,6 +44,7 @@ SRC_URI = "\
      file://CVE-2018-7569.patch \
      file://CVE-2018-7568.patch \
      file://CVE-2018-10373.patch \
+     file://CVE-2018-10372.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-10372.patch new file +58 -0

58 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #10 lore raw

PATCH 11/12 binutls: Security fix CVE-2018-10535

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-10535.patch         | 61 ++++++++++++++++++++++
 2 files changed, 62 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-10535.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 8693757..f8ac1ca 100644
@@ -45,6 +45,7 @@ SRC_URI = "\
      file://CVE-2018-7568.patch \
      file://CVE-2018-10373.patch \
      file://CVE-2018-10372.patch \
+     file://CVE-2018-10535.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-10535.patch new file +61 -0

61 lines not on this page · raw message

Signature · 1 line

2.7.4

Armin Kuster

author

2018-08-06 14:29 UTC #11 lore raw

PATCH 12/12 binutls: Security fix CVE-2018-10534

In reply to Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |    1 +
 .../binutils/binutils/CVE-2018-10534.patch         | 3429 ++++++++++++++++++++
 2 files changed, 3430 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-10534.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index f8ac1ca..37243db 100644
@@ -46,6 +46,7 @@ SRC_URI = "\
      file://CVE-2018-10373.patch \
      file://CVE-2018-10372.patch \
      file://CVE-2018-10535.patch \
+     file://CVE-2018-10534.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-10534.patch new file +3429 -0

2,993 lines not on this page · raw message

The rest of this diff is not shown. View the raw message.

Signature · 1 line

2.7.4

Part of the diff is not shown here. View the raw message.

Patchwork

2018-08-06 15:06 UTC #12 lore raw

✗ patchtest: failure for "[SUMO] binutils: Security fix ..." and 11 more

In reply to Armin Kuster

== Series Details ==

Series: "[SUMO] binutils: Security fix ..." and 11 more
Revision: 1
URL : https://patchwork.openembedded.org/series/13401/
State : failure

== Summary ==

Thank you for submitting this patch series to OpenEmbedded Core. This is an automated response. Several tests have been executed on the proposed series by patchtest resulting in the following failures:

* Issue Added patch file is missing Upstream-Status in the header [test_upstream_status_presence_format]

  Suggested fix    Add Upstream-Status: <Valid status> to the header of meta/recipes-devtools/binutils/binutils/CVE-2018-8945.patch
  Standard format  Upstream-Status: <Valid status>
  Valid status     Pending, Accepted, Backport, Denied, Inappropriate [reason], Submitted [where]

If you believe any of these test results are incorrect, please reply to the mailing list ([email protected]) raising your concerns. Otherwise we would appreciate you correcting the issues and submitting a new version of the patchset if applicable. Please ensure you add/increment the version number when sending the new version (i.e. [PATCH] -> [PATCH v2] -> [PATCH v3] -> ...).

---

Guidelines:     https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite:     http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe

Khem Raj

2018-08-06 17:27 UTC #13 lore raw

In reply to Armin Kuster

this series is ok. Although a single patch would be ok as well.

Quoted 108 lines · Armin Kuster

From: Armin Kuster <[email protected]>

Affects <= 2.30

Signed-off-by Armin Kuster <[email protected]>

---
 meta/recipes-devtools/binutils/binutils-2.30.inc   |  1 +
 .../binutils/binutils/CVE-2018-8945.patch          | 70 ++++++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2018-8945.patch

meta/recipes-devtools/binutils/binutils-2.30.inc +1 -0

index 9c883ac..349fa5a 100644
@@ -35,6 +35,7 @@ SRC_URI = "\
      file://0013-fix-the-incorrect-assembling-for-ppc-wait-mnemonic.patch \
      file://0014-Detect-64-bit-MIPS-targets.patch \
      file://0015-sync-with-OE-libtool-changes.patch \
+     file://CVE-2018-8945.patch \
 "
 S  = "${WORKDIR}/git"

meta/recipes-devtools/binutils/binutils/CVE-2018-8945.patch new file +70 -1

new file mode 100644
index 0000000..6a43168
@@ -0,0 +1,70 @@
+From 95a6d23566165208853a68d9cd3c6eedca840ec6 Mon Sep 17 00:00:00 2001
+From: Nick Clifton <[email protected]>
+Date: Tue, 8 May 2018 12:51:06 +0100
+Subject: [PATCH] Prevent a memory exhaustion failure when running objdump on a
+ fuzzed input file with corrupt string and attribute sections.
+
+       PR 22809
+       * elf.c (bfd_elf_get_str_section): Check for an excessively large
+       string section.
+       * elf-attrs.c (_bfd_elf_parse_attributes): Issue an error if the
+       attribute section is larger than the size of the file.
+
+Upsteram-Status: Backport
+Affects: Binutils <= 2.30
+CVE: CVE-2018-8945
+Signed-off-by: Armin kuster <[email protected]>
+---
+ bfd/ChangeLog   | 8 ++++++++
+ bfd/elf-attrs.c | 9 +++++++++
+ bfd/elf.c       | 1 +
+ 3 files changed, 18 insertions(+)
+
+Index: git/bfd/elf-attrs.c
+===================================================================
+--- git.orig/bfd/elf-attrs.c
++++ git/bfd/elf-attrs.c
+@@ -438,6 +438,15 @@ _bfd_elf_parse_attributes (bfd *abfd, El
+   /* PR 17512: file: 2844a11d.  */
+   if (hdr->sh_size == 0)
+     return;
++  if (hdr->sh_size > bfd_get_file_size (abfd))
++    {
++      /* xgettext:c-format */
++      _bfd_error_handler (_("%pB: error: attribute section '%pA' too big: %#llx"),
++                        abfd, hdr->bfd_section, (long long) hdr->sh_size);
++      bfd_set_error (bfd_error_invalid_operation);
++      return;
++    }
++
+   contents = (bfd_byte *) bfd_malloc (hdr->sh_size + 1);
+   if (!contents)
+     return;
+Index: git/bfd/elf.c
+===================================================================
+--- git.orig/bfd/elf.c
++++ git/bfd/elf.c
+@@ -298,6 +298,7 @@ bfd_elf_get_str_section (bfd *abfd, unsi
+       /* Allocate and clear an extra byte at the end, to prevent crashes
+        in case the string table is not terminated.  */
+       if (shstrtabsize + 1 <= 1
++        || shstrtabsize > bfd_get_file_size (abfd)
+         || bfd_seek (abfd, offset, SEEK_SET) != 0
+         || (shstrtab = (bfd_byte *) bfd_alloc (abfd, shstrtabsize + 1)) == NULL)
+       shstrtab = NULL;
+Index: git/bfd/ChangeLog
+===================================================================
+--- git.orig/bfd/ChangeLog
++++ git/bfd/ChangeLog
+@@ -1,3 +1,11 @@
++2018-05-08  Nick Clifton  <[email protected]>
++
++       PR 22809
++       * elf.c (bfd_elf_get_str_section): Check for an excessively large
++       string section.
++       * elf-attrs.c (_bfd_elf_parse_attributes): Issue an error if the
++       attribute section is larger than the size of the file.
++
+ 2018-02-07  Alan Modra  <[email protected]>
+
+       Revert 2018-01-17  Alan Modra  <[email protected]>
--

2.7.4

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core