Wind River Support Network

HomeDefectsLIN10-5935
Fixed

LIN10-5935 : Incomplete fix of CVE-2018-18309

Created: May 29, 2019    Updated: Aug 15, 2019
Resolved Date: Jun 18, 2019
Found In Version: 10.17.41.1
Fix Version: 10.17.41.17
Severity: Standard
Applicable for: Wind River Linux LTS 17
Component/s: Build & Config

Description

While using WRL LTS18 RCPL5 was compiling a custom application that is linked to a library supplied by i2c-tools package, a linker (ld) error was triggered:

"DWARF error: invalid abstract instance DIE ref"

This bug was already fixed in binutils mainline, please see: https://sourceware.org/bugzilla/show_bug.cgi?id=23425

The problem is that bug fix has two commits, and only one of them was included in WRL LTS18 through CVE-2018-18309.patch, while the other fix is missing.

"...

commit a4cd947aca23d58966ead843e120f4c19db01030
 Author: Alan Modra <[amodra@gmail.com|mailto:amodra@gmail.com]>
 Date:   Tue Sep 11 23:50:15 2018 +0930
 [PR23425|https://sourceware.org/bugzilla/show_bug.cgi?id=23425], *unresolved symbol diagnostic* {color:#FF0000}-->> this patch is not applied{color}

….

commit 0930cb3021b8078b34cf216e79eb8608d017864f
 Author: Alan Modra <[amodra@gmail.com|mailto:amodra@gmail.com]>
 Date:   Sat Oct 13 22:03:02 2018 +1030
 *_bfd_clear_contents bounds checking"*

The second patch is there, but this patch is required for fix something from a previous patch, while the previous patch isn’t there,

Please make the necessary effort to include both fixes in the next RCPL.

 

 

Steps to Reproduce

Start in a WRL LTS18 project directory.

$ find . -name binutils

./oe-core/meta/recipes-devtools/binutils

./oe-core/meta/recipes-devtools/binutils/binutils

$ cd oe-core/meta/recipes-devtools/binutils/binutils

{color:#00b050}--> this directory has all the patches. We grep the whole dir for our desired string:{color}

$ grep "unresolved symbol diagnostic" * {color:#00b050}--> nothing came out, then we check for the other string{color}

$ grep "bfd_clear_contents bounds checking" *

CVE-2018-18309.patch:Subject: [PATCH] _bfd_clear_contents bounds checking

So this patch is relevant for the second thing fixed in that bugzilla link. And it doesn’t include the fix from the first patch.

 
Live chat
Online