CVE-2021-20294

A flaw was found in binutils readelf 2.35 program. An attacker who is able to convince a victim using readelf to read a crafted file could trigger a stack buffer overflow, out-of-bounds write of arbitrary data supplied by the attacker. The highest impact of this flaw is to confidentiality, integrity, and availability.

This update for binutils fixes the following issues:

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

• General:

  • When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
  • Added a .nop directive to generate a single no-op instruction in a target neutral manner. This instruction does have an effect on DWARF line number generation, if that is active.
  • Removed --reduce-memory-overheads and --hash-size as gas now uses hash tables that can be expand and shrink automatically.

• X86/x86_64:

  • Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key Locker instructions.
  • Support non-absolute segment values…

This update for binutils fixes the following issues:

• For compatibility on old code stream that expect 'brcl 0,label' to not be disassembled as 'jgnop label' on s390x. (bsc#1192267) This reverts IBM zSeries HLASM support for now.
• Fixed that ppc64 optflags did not enable LTO (bsc#1188941).
• Fix empty man-pages from broken release tarball
• Fixed a memory corruption with rpath option (bsc#1191473).
• Fixed slow performance of stripping some binaries (bsc#1183909).

Security issue fixed:

• CVE-2021-20294: Fixed out-of-bounds write in print_dynamic_symbol in readelf (bnc#1184519)

These are all security issues fixed in the binutils-2.37-3.1 package on the GA media of openSUSE Tumbleweed.

This update for binutils fixes the following issues:

• For compatibility on old code stream that expect 'brcl 0,label' to not be disassembled as 'jgnop label' on s390x. (bsc#1192267) This reverts IBM zSeries HLASM support for now.

• Fixed that ppc64 optflags did not enable LTO (bsc#1188941).

• Fix empty man-pages from broken release tarball

• Fixed a memory corruption with rpath option (bsc#1191473).

• Fixed slow performance of stripping some binaries (bsc#1183909).

Security issue fixed:

• CVE-2021-20294: Fixed out-of-bounds write in print_dynamic_symbol in readelf (bnc#1184519)

This update for binutils fixes the following issues:

• For compatibility on old code stream that expect 'brcl 0,label' to not be disassembled as 'jgnop label' on s390x. (bsc#1192267) This reverts IBM zSeries HLASM support for now.
• Fixed that ppc64 optflags did not enable LTO (bsc#1188941).
• Fix empty man-pages from broken release tarball
• Fixed a memory corruption with rpath option (bsc#1191473).
• Fixed slow performance of stripping some binaries (bsc#1183909).

Security issue fixed:

• CVE-2021-20294: Fixed out-of-bounds write in print_dynamic_symbol in readelf (bnc#1184519)

This update for binutils fixes the following issues:

• For compatibility on old code stream that expect 'brcl 0,label' to not be disassembled as 'jgnop label' on s390x. (bsc#1192267) This reverts IBM zSeries HLASM support for now.
• Fixed that ppc64 optflags did not enable LTO (bsc#1188941).
• Fix empty man-pages from broken release tarball
• Fixed a memory corruption with rpath option (bsc#1191473).
• Fixed slow performance of stripping some binaries (bsc#1183909).

Update to binutils 2.37:

• The GNU Binutils sources now requires a C99 compiler and library to build.

• Support for Realm Management Extension (RME) for AArch64 has been added.

• A new linker option '-z report-relative-reloc' for x86 ELF targets has been added to report dynamic relative relocations.

• A new linker option '-z start-stop-gc' has been added to disable special treatment of _start/_stop references when --gc-sections.

• A new linker options '-Bno-symbolic' has been added which will cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.

• The readelf tool has a new command line option which can be used to specify how the numeric values of symbols are reported. --sym-base=0|8|10|16 tells readelf to display the values in base 8, base 10 or base 16. A sym base of 0 represents the default action of displaying values under 10000 in base 10 and values above that in base 16.

• A new format has been added to the nm program. Specifying '--format=just-symbols' (or just using -j) will tell the program to only display symbol names and nothing else.

• A new command line option '--keep-section-symbols' has been added to objcopy and strip. This stops the removal of unused section symbols when the file is copied. Removing these symbols saves space, but sometimes they are needed by other tools.

• The '--weaken', '--weaken-symbol' and '--weaken-symbols' options supported by objcopy now make undefined symbols weak on targets that support weak symbols.

• Readelf and objdump can now display and use the contents of .debug_sup sections.

• Readelf and objdump will now follow links to separate debug info files by default. This behaviour can be stopped via the use of the new '-wN' or '--debug-dump=no-follow-links' options for readelf and the '-WN' or '--dwarf=no-follow-links' options for objdump. Also the old behaviour can be restored by the use of the '--enable-follow-debug-links=no' configure time option.

  The semantics of the =follow-links option have also been slightly changed. When enabled, the option allows for the loading of symbol tables and string tables from the separate files which can be used to enhance the information displayed when dumping other sections, but it does not automatically imply that information from the separate files should be displayed.

  If other debug section display options are also enabled (eg '--debug-dump=info') then the contents of matching sections in both the main file and the separate debuginfo file will be displayed. This is because in most cases the debug section will only be present in one of the files.

  If however non-debug section display options are enabled (eg '--sections') then the contents of matching parts of the separate debuginfo file will not be displayed. This is because in most cases the user probably only wanted to load the symbol information from the separate debuginfo file. In order to change this behaviour a new command line option --process-links can be used. This will allow di0pslay options to applied to both the main file and any separate debuginfo files.

• Nm has a new command line option: '--quiet'. This suppresses 'no symbols' diagnostic.

Update to binutils 2.36:

New features in the Assembler:

• General:

  • When setting the link order attribute of ELF sections, it is now possible to use a numeric section index instead of symbol name.
  • Added a .nop directive to generate a single…