rpms/binutils
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
binutils/binutils-CVE-2025-11495.patch

198 lines
6.8 KiB
Diff
Raw Permalink Blame History

From 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0 Mon Sep 17 00:00:00 2001
From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Tue, 30 Sep 2025 08:18:29 +0800
Subject: [PATCH] x86: Disallow TLS relocation in non executable section
Since TLS relocations are applied to executable machine instructions,
disallow TLS relocation in non-SHT_PROGBITS, non-SHF_EXECINSTR section.
PR ld/33451
PR ld/33502
* elf32-i386.c (elf_i386_tls_transition): Disallow TLS relocation
in non-SHT_PROGBITS, non-SHF_EXECINSTR section.
(elf_i386_scan_relocs): Likewise.
* elf64-x86-64.c (elf_x86_64_tls_transition): Likewise.
(elf_x86_64_scan_relocs): Likewise.
* elfxx-x86.c (_bfd_x86_elf_link_report_tls_invalid_section_error):
New.
* elfxx-x86.h (_bfd_x86_elf_link_report_tls_invalid_section_error):
Likewise.
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
---
bfd/elf32-i386.c | 19 +++++++++++++++++++
bfd/elf64-x86-64.c | 20 ++++++++++++++++++++
bfd/elfxx-x86.c | 20 ++++++++++++++++++++
bfd/elfxx-x86.h | 4 ++++
4 files changed, 63 insertions(+)
diff -rup binutils-with-gold-2.44.orig/bfd/elf32-i386.c binutils-with-gold-2.44/bfd/elf32-i386.c
--- binutils-with-gold-2.44.orig/bfd/elf32-i386.c 2025-10-10 10:27:34.128669391 +0100
+++ binutils-with-gold-2.44/bfd/elf32-i386.c 2025-10-10 10:27:45.159754790 +0100
@@ -1166,6 +1166,15 @@ elf_i386_tls_transition (struct bfd_link
return true;
}
+ if ((elf_section_type (sec) != SHT_PROGBITS
+ || (sec->flags & SEC_CODE) == 0))
+ {
+ reloc_howto_type *howto = elf_i386_rtype_to_howto (from_type);
+ _bfd_x86_elf_link_report_tls_invalid_section_error
+ (abfd, sec, symtab_hdr, h, sym, howto);
+ return false;
+ }
+
/* Return TRUE if there is no transition. */
if (from_type == to_type)
return true;
@@ -1685,6 +1694,16 @@ elf_i386_scan_relocs (bfd *abfd,
tls_type = GOT_TLS_IE_POS; break;
}
+ if (tls_type >= GOT_TLS_GD
+ && tls_type <= GOT_TLS_GDESC
+ && (elf_section_type (sec) != SHT_PROGBITS
+ || (sec->flags & SEC_CODE) == 0))
+ {
+ _bfd_x86_elf_link_report_tls_invalid_section_error
+ (abfd, sec, symtab_hdr, h, isym, howto);
+ goto error_return;
+ }
+
if (h != NULL)
{
h->got.refcount = 1;
diff -rup binutils-with-gold-2.44.orig/bfd/elf64-x86-64.c binutils-with-gold-2.44/bfd/elf64-x86-64.c
--- binutils-with-gold-2.44.orig/bfd/elf64-x86-64.c 2025-10-10 10:27:34.147669538 +0100
+++ binutils-with-gold-2.44/bfd/elf64-x86-64.c 2025-10-10 10:27:45.161165453 +0100
@@ -1598,6 +1598,16 @@ elf_x86_64_tls_transition (struct bfd_li
return true;
}
+ if ((elf_section_type (sec) != SHT_PROGBITS
+ || (sec->flags & SEC_CODE) == 0))
+ {
+ reloc_howto_type *howto = elf_x86_64_rtype_to_howto (abfd,
+ from_type);
+ _bfd_x86_elf_link_report_tls_invalid_section_error
+ (abfd, sec, symtab_hdr, h, sym, howto);
+ return false;
+ }
+
/* Return TRUE if there is no transition. */
if (from_type == to_type
|| (from_type == R_X86_64_CODE_4_GOTTPOFF
@@ -2351,6 +2361,16 @@ elf_x86_64_scan_relocs (bfd *abfd, struc
break;
}
+ if (tls_type >= GOT_TLS_GD
+ && tls_type <= GOT_TLS_GDESC
+ && (elf_section_type (sec) != SHT_PROGBITS
+ || (sec->flags & SEC_CODE) == 0))
+ {
+ _bfd_x86_elf_link_report_tls_invalid_section_error
+ (abfd, sec, symtab_hdr, h, isym, howto);
+ goto error_return;
+ }
+
if (h != NULL)
{
h->got.refcount = 1;
diff -rup binutils-with-gold-2.44.orig/bfd/elfxx-x86.c binutils-with-gold-2.44/bfd/elfxx-x86.c
--- binutils-with-gold-2.44.orig/bfd/elfxx-x86.c 2025-10-10 10:27:34.204669979 +0100
+++ binutils-with-gold-2.44/bfd/elfxx-x86.c 2025-10-10 10:27:45.161625095 +0100
@@ -3359,6 +3359,26 @@ _bfd_x86_elf_link_report_tls_transition_
bfd_set_error (bfd_error_bad_value);
}
+/* Report TLS invalid section error. */
+
+void
+_bfd_x86_elf_link_report_tls_invalid_section_error
+ (bfd *abfd, asection *sec, Elf_Internal_Shdr *symtab_hdr,
+ struct elf_link_hash_entry *h, Elf_Internal_Sym *sym,
+ reloc_howto_type *howto)
+{
+ const char *name;
+ if (h)
+ name = h->root.root.string;
+ else
+ name = bfd_elf_sym_name (abfd, symtab_hdr, sym, NULL);
+ _bfd_error_handler
+ /* xgettext:c-format */
+ (_("%pB: relocation %s against thread local symbol `%s' in "
+ "invalid section `%pA'"), abfd, howto->name, name, sec);
+ bfd_set_error (bfd_error_bad_value);
+}
+
/* Return TRUE if symbol should be hashed in the `.gnu.hash' section. */
bool
diff -rup binutils-with-gold-2.44.orig/bfd/elfxx-x86.h binutils-with-gold-2.44/bfd/elfxx-x86.h
--- binutils-with-gold-2.44.orig/bfd/elfxx-x86.h 2025-10-10 10:27:34.157669616 +0100
+++ binutils-with-gold-2.44/bfd/elfxx-x86.h 2025-10-10 10:27:45.162048003 +0100
@@ -939,6 +939,10 @@ extern void _bfd_x86_elf_link_report_tls
const Elf_Internal_Rela *, const char *, const char *,
enum elf_x86_tls_error_type);
+extern void _bfd_x86_elf_link_report_tls_invalid_section_error
+ (bfd *, asection *, Elf_Internal_Shdr *, struct elf_link_hash_entry *,
+ Elf_Internal_Sym *, reloc_howto_type *);
+
#define bfd_elf64_mkobject \
_bfd_x86_elf_mkobject
#define bfd_elf32_mkobject \
--- binutils-with-gold-2.44.orig/bfd/elf64-x86-64.c 2025-10-10 10:58:00.684202576 +0100
+++ binutils-with-gold-2.44/bfd/elf64-x86-64.c 2025-10-10 11:01:54.310462809 +0100
@@ -2169,6 +2169,7 @@ elf_x86_64_scan_relocs (bfd *abfd, struc
bool size_reloc;
bool converted_reloc;
bool no_dynreloc;
+ reloc_howto_type *howto;
r_symndx = htab->r_sym (rel->r_info);
r_type = ELF32_R_TYPE (rel->r_info);
@@ -2185,6 +2186,14 @@ elf_x86_64_scan_relocs (bfd *abfd, struc
goto error_return;
}
+ howto = elf_x86_64_rtype_to_howto (abfd, r_type);
+ if (howto == NULL)
+ {
+ _bfd_error_handler (_("%pB: unsupported relocation type %#x"),
+ abfd, r_type);
+ goto error_return;
+ }
+
if (r_symndx < symtab_hdr->sh_info)
{
/* A local symbol. */
--- binutils-with-gold-2.44.orig/bfd/elf32-i386.c 2025-10-10 11:05:23.893062517 +0100
+++ binutils-with-gold-2.44/bfd/elf32-i386.c 2025-10-10 11:06:31.136544677 +0100
@@ -1540,6 +1540,7 @@ elf_i386_scan_relocs (bfd *abfd,
const char *name;
bool size_reloc;
bool no_dynreloc;
+ reloc_howto_type *howto;
r_symndx = ELF32_R_SYM (rel->r_info);
r_type = ELF32_R_TYPE (rel->r_info);
@@ -1556,6 +1557,17 @@ elf_i386_scan_relocs (bfd *abfd,
goto error_return;
}
+ howto = elf_i386_rtype_to_howto (r_type);
+ if (rel->r_offset + bfd_get_reloc_size (howto) > sec->size)
+ {
+ /* xgettext:c-format */
+ _bfd_error_handler
+ (_("%pB: bad reloc offset (%#" PRIx32 " > %#" PRIx32 ") for"
+ " section `%pA'"), abfd, (uint32_t) rel->r_offset,
+ (uint32_t) sec->size, sec);
+ goto error_return;
+ }
+
if (r_symndx < symtab_hdr->sh_info)
{
/* A local symbol. */
Reference in a new issue View git blame Copy permalink