Re: Clarification on CVE-2025-1176 Fix Backport – Bug 32636 in binutils-2_44 and other older Branch

[Nick Clifton]

Hi Dora,

> I'm writing regarding Bug 32636 <https://sourceware.org/bugzilla/show_bug.cgi?id=32636>, which concerns a heap-buffer-overflow in ld triggered in _bfd_elf_gc_mark_rsec 
> (bfd/elflink.c).

The first thing to note is that this bug is not really a CVE in that in
involves using the linker's -w (or --no-warnings) option which tells the
linker to continue processing even after it has encountered an issue which
will prevent it from generating a working binary.  Since such an option
would never be used when creating real programs, it is unfair to consider
it as a critical vulnerability.


> I attempted to backport this fix to the binutils-2_44 branch and 2_42 as well, but unfortunately the issue still reproduces on my end when using the same proof-of-concept 
> input. I’ve double-checked the patch application, and the build completes without errors, yet AddressSanitizer continues to report the same heap-buffer-overflow.
> 
> Could you please advise:
> 
> Whether additional patches or supporting changes are needed beyond
> that commit to fully address the issue in 2.44?

There are indeed several other commits which cover the area affected
by this bug.  Specifically the commits for PR 32641, PR 32643 and PR 32644.
Together they should form a complete fix for the problems reported in
all four PRs.

The commit IDs for these other three PRs are:

   PR 32644: commit b425859021d17adf62f06fb904797cf8642986ad
   PR 32643: commit 931494c9a89558acb36a03a340c01726545eef24
   PR 32641: commit 18cc11a2771d9e40180485da9a4fb660c03efac3

I hope that this helps,

Cheers
   Nick