Security update for binutils

Announcement ID:	SUSE-SU-2022:4277-1
Rating:	important
References:	bsc#1142579 bsc#1185597 bsc#1185712 bsc#1188374 bsc#1191473 bsc#1191908 bsc#1193929 bsc#1194783 bsc#1197592 bsc#1198237 bsc#1198458 bsc#1202816 bsc#1202966 bsc#1202967 bsc#1202969 jsc#PED-2029 jsc#PED-2030 jsc#PED-2031 jsc#PED-2032 jsc#PED-2033 jsc#PED-2034 jsc#PED-2035 jsc#PED-2038 jsc#SLE-25046 jsc#SLE-25047
Cross-References:	CVE-2019-1010204 CVE-2021-3530 CVE-2021-3648 CVE-2021-3826 CVE-2021-45078 CVE-2021-46195 CVE-2022-27943 CVE-2022-38126 CVE-2022-38127 CVE-2022-38533
CVSS scores:	CVE-2019-1010204 ( SUSE ): 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2019-1010204 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-1010204 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3530 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-3530 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3648 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-3826 ( SUSE ): 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H CVE-2021-3826 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45078 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-45078 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-46195 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-46195 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-27943 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-27943 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-38126 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38126 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-38127 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38127 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-38533 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2022-38533 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9

An update that solves 10 vulnerabilities, contains 10 features and has five security fixes can now be installed.

Description:

This update for binutils fixes the following issues: The following security bugs were fixed:

• CVE-2019-1010204: Fixed out-of-bounds read in elfcpp/elfcpp_file.h (bsc#1142579).
• CVE-2021-3530: Fixed stack-based buffer overflow in demangle_path() in rust-demangle.c (bsc#1185597).
• CVE-2021-3648: Fixed infinite loop while demangling rust symbols (bsc#1188374).
• CVE-2021-3826: Fixed heap/stack buffer overflow in the dlang_lname function in d-demangle.c (bsc#1202969).
• CVE-2021-45078: Fixed out-of-bounds write in stab_xcoff_builtin_type() in stabs.c (bsc#1193929).
• CVE-2021-46195: Fixed uncontrolled recursion in libiberty/rust-demangle.c (bsc#1194783).
• CVE-2022-27943: Fixed stack exhaustion in demangle_const in (bsc#1197592).
• CVE-2022-38126: Fixed assertion fail in the display_debug_names() function in binutils/dwarf.c (bsc#1202966).
• CVE-2022-38127: Fixed NULL pointer dereference in the read_and_display_attr_value() function in binutils/dwarf.c (bsc#1202967).
• CVE-2022-38533: Fixed heap out-of-bounds read in bfd_getl32 (bsc#1202816).

The following non-security bugs were fixed:

• SLE toolchain update of binutils, update to 2.39 from 2.37.
• Update to 2.39:
• The ELF linker will now generate a warning message if the stack is made executable. Similarly it will warn if the output binary contains a segment with all three of the read, write and execute permission bits set. These warnings are intended to help developers identify programs which might be vulnerable to attack via these executable memory regions. The warnings are enabled by default but can be disabled via a command line option. It is also possible to build a linker with the warnings disabled, should that be necessary.
• The ELF linker now supports a --package-metadata option that allows embedding a JSON payload in accordance to the Package Metadata specification.
• In linker scripts it is now possible to use TYPE=<type> in an output section description to set the section type value.
• The objdump program now supports coloured/colored syntax highlighting of its disassembler output for some architectures. (Currently: AVR, RiscV, s390, x86, x86_64).
• The nm program now supports a --no-weak/-W option to make it ignore weak symbols.
• The readelf and objdump programs now support a -wE option to prevent them from attempting to access debuginfod servers when following links.

• The objcopy program's --weaken, --weaken-symbol, and --weaken-symbols options now works with unique symbols as well.

• Update to 2.38:

• elfedit: Add --output-abiversion option to update ABIVERSION.
• Add support for the LoongArch instruction set.
• Tools which display symbols or strings (readelf, strings, nm, objdump) have a new command line option which controls how unicode characters are handled. By default they are treated as normal for the tool. Using --unicode=locale will display them according to the current locale. Using --unicode=hex will display them as hex byte values, whilst --unicode=escape will display them as escape sequences. In addition using --unicode=highlight will display them as unicode escape sequences highlighted in red (if supported by the output device).
• readelf -r dumps RELR relative relocations now.
• Support for efi-app-aarch64, efi-rtdrv-aarch64 and efi-bsdrv-aarch64 has been added to objcopy in order to enable UEFI development using binutils (bsc#1198458).
• ar: Add --thin for creating thin archives. -T is a deprecated alias without diagnostics. In many ar implementations -T has a different meaning, as specified by X/Open System Interface.
• Add support for AArch64 system registers that were missing in previous releases.
• Add support for the LoongArch instruction set.
• Add a command-line option, -muse-unaligned-vector-move, for x86 target to encode aligned vector move as unaligned vector move.
• Add support for Cortex-R52+ for Arm.
• Add support for Cortex-A510, Cortex-A710, Cortex-X2 for AArch64.
• Add support for Cortex-A710 for Arm.
• Add support for Scalable Matrix Extension (SME) for AArch64.
• The --multibyte-handling=[allow|warn|warn-sym-only] option tells the assembler what to when it encoutners multibyte characters in the input. The default is to allow them. Setting the option to "warn" will generate a warning message whenever any multibyte character is encountered. Using the option to "warn-sym-only" will make the assembler generate a warning whenever a symbol is defined containing multibyte characters. (References to undefined symbols will not generate warnings).
• Outputs of .ds.x directive and .tfloat directive with hex input from x86 assembler have been reduced from 12 bytes to 10 bytes to match the output of .tfloat directive.
• Add support for 'armv8.8-a', 'armv9-a', 'armv9.1-a', 'armv9.2-a' and 'armv9.3-a' for -march in AArch64 GAS.
• Add support for 'armv8.7-a', 'armv8.8-a', 'armv9-a', 'armv9.1-a', 'armv9.2-a' and 'armv9.3-a' for -march in Arm GAS.
• Add support for Intel AVX512_FP16 instructions.
• Add -z pack-relative-relocs/-z no pack-relative-relocs to x86 ELF linker to pack relative relocations in the DT_RELR section.
• Add support for the LoongArch architecture.
• Add -z indirect-extern-access/-z noindirect-extern-access to x86 ELF linker to control canonical function pointers and copy relocation.

• Add --max-cache-size=SIZE to set the the maximum cache size to SIZE bytes.

• Fixed regression that prevented .ko.debug to be loaded in crash tool (bsc#1191908).

• Explicitly enable --enable-warn-execstack=yes and --enable-warn-rwx-segments=yes.
• Add gprofng subpackage.
• Include recognition of 'z16' name for 'arch14' on s390. (bsc#1198237).
• Add back fix for bsc#1191473, which got lost in the update to 2.38.
• Install symlinks for all target specific tools on arm-eabi-none (bsc#1185712).
• Enable PRU architecture for AM335x CPU (Beagle Bone Black board)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE OpenStack Cloud 9
  zypper in -t patch SUSE-OpenStack-Cloud-9-2022-4277=1
• SUSE OpenStack Cloud Crowbar 9
  zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-4277=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-4277=1
• SUSE Linux Enterprise Software Development Kit 12 SP5
  zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-4277=1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-4277=1
• SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-4277=1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2022-4277=1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-4277=1
• SUSE Linux Enterprise High Performance Computing 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4277=1
• SUSE Linux Enterprise Server 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4277=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4277=1

Package List:

• SUSE OpenStack Cloud 9 (x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE OpenStack Cloud Crowbar 9 (x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64)
  • cross-spu-binutils-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • cross-ppc-binutils-debuginfo-2.39-9.50.1
  • cross-spu-binutils-debugsource-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • binutils-gold-debuginfo-2.39-9.50.1
  • cross-ppc-binutils-2.39-9.50.1
  • cross-spu-binutils-2.39-9.50.1
  • binutils-gold-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • cross-ppc-binutils-debugsource-2.39-9.50.1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 (x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
  • libctf0-debuginfo-2.39-9.50.1
  • binutils-debuginfo-2.39-9.50.1
  • libctf0-2.39-9.50.1
  • binutils-devel-2.39-9.50.1
  • binutils-debugsource-2.39-9.50.1
  • libctf-nobfd0-debuginfo-2.39-9.50.1
  • libctf-nobfd0-2.39-9.50.1
  • binutils-2.39-9.50.1

References:

• https://www.suse.com/security/cve/CVE-2019-1010204.html
• https://www.suse.com/security/cve/CVE-2021-3530.html
• https://www.suse.com/security/cve/CVE-2021-3648.html
• https://www.suse.com/security/cve/CVE-2021-3826.html
• https://www.suse.com/security/cve/CVE-2021-45078.html
• https://www.suse.com/security/cve/CVE-2021-46195.html
• https://www.suse.com/security/cve/CVE-2022-27943.html
• https://www.suse.com/security/cve/CVE-2022-38126.html
• https://www.suse.com/security/cve/CVE-2022-38127.html
• https://www.suse.com/security/cve/CVE-2022-38533.html
• https://bugzilla.suse.com/show_bug.cgi?id=1142579
• https://bugzilla.suse.com/show_bug.cgi?id=1185597
• https://bugzilla.suse.com/show_bug.cgi?id=1185712
• https://bugzilla.suse.com/show_bug.cgi?id=1188374
• https://bugzilla.suse.com/show_bug.cgi?id=1191473
• https://bugzilla.suse.com/show_bug.cgi?id=1191908
• https://bugzilla.suse.com/show_bug.cgi?id=1193929
• https://bugzilla.suse.com/show_bug.cgi?id=1194783
• https://bugzilla.suse.com/show_bug.cgi?id=1197592
• https://bugzilla.suse.com/show_bug.cgi?id=1198237
• https://bugzilla.suse.com/show_bug.cgi?id=1198458
• https://bugzilla.suse.com/show_bug.cgi?id=1202816
• https://bugzilla.suse.com/show_bug.cgi?id=1202966
• https://bugzilla.suse.com/show_bug.cgi?id=1202967
• https://bugzilla.suse.com/show_bug.cgi?id=1202969
• https://jira.suse.com/browse/PED-2029
• https://jira.suse.com/browse/PED-2030
• https://jira.suse.com/browse/PED-2031
• https://jira.suse.com/browse/PED-2032
• https://jira.suse.com/browse/PED-2033
• https://jira.suse.com/browse/PED-2034
• https://jira.suse.com/browse/PED-2035
• https://jira.suse.com/browse/PED-2038
• https://jira.suse.com/browse/SLE-25046
• https://jira.suse.com/browse/SLE-25047