From 705360dd7200d4d3ef6cc85746c7d9dafc798680 Mon Sep 17 00:00:00 2001 From: Marta Lewandowska Date: Wed, 27 Nov 2024 11:03:43 -0600 Subject: [PATCH 01/10] 99-grub-mkconfig.install: Disable BLS and run grub2-mkconfig when GRUB_ENABLE_BLSCFG is disable Resolves: #2325960 Signed-off-by: Marta Lewandowska Reviewed-by: Leo Sandoval --- 99-grub-mkconfig.install | 6 ++++++ grub2.spec | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index 1411f6ac..8048648c 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -4,6 +4,12 @@ if ! [[ $KERNEL_INSTALL_MACHINE_ID ]]; then exit 0 fi +# Run grub2-mkconfig if ENABLE_BLSCFG is false +if grep -q '^GRUB_ENABLE_BLSCFG="*false"*\s*$' /etc/default/grub; then + RUN_MKCONFIG=true + DISABLE_BLS=true +fi + # PV and PVH Xen DomU guests boot with pygrub that doesn't have BLS support, # also Xen Dom0 use the menuentries from 20_linux_xen and not the ones from # 10_linux. So BLS support needs to be disabled for both Xen Dom0 and DomU. diff --git a/grub2.spec b/grub2.spec index 01a889b4..3ed24660 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 15%{?dist} +Release: 16%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Wed Nov 27 2024 Marta Lewandowska - 2.12-16 +- 99-grub-mkconfig.install: Disable BLS and run grub2-mkconfig when GRUB_ENABLE_BLSCFG is disable +- Resolves: #2325960 + * Thu Nov 21 2024 Andrea Bolognani 2.12-15 - Add riscv64 support (thanks Jason Montleon) From 5935ba175c266836c97bde07657e1b78f0186e65 Mon Sep 17 00:00:00 2001 From: Marta Lewandowska Date: Wed, 27 Nov 2024 11:10:45 -0600 Subject: [PATCH 02/10] 99-grub-mkconfig.install: on PPC systems, remove petiboot's version checks On PPC systems, there is no need to check petiboot's version, so remove all related lines and unconditionally turn on the corresponding flag. Signed-off-by: Marta Lewandowska Reviewed-by: Leo Sandoval --- 99-grub-mkconfig.install | 21 +++------------------ grub2.spec | 5 ++++- 2 files changed, 7 insertions(+), 19 deletions(-) diff --git a/99-grub-mkconfig.install b/99-grub-mkconfig.install index 8048648c..a14f5fd8 100755 --- a/99-grub-mkconfig.install +++ b/99-grub-mkconfig.install @@ -21,25 +21,10 @@ if [[ -e /sys/hypervisor/type ]] && grep -q "^xen$" /sys/hypervisor/type; then fi ARCH=$(uname -m) -# Older ppc64le OPAL firmware (petitboot version < 1.8.0) don't have BLS support -# so grub2-mkconfig has to be run to generate a config with menuentry commands. +# Older ppc64le OPAL firmware don't have BLS support so grub2-mkconfig has to be +# run to generate a config with menuentry commands. if [[ $ARCH = "ppc64le" ]] && [ -d /sys/firmware/opal ]; then - - petitboot_path="/sys/firmware/devicetree/base/ibm,firmware-versions/petitboot" - - if test -e ${petitboot_path}; then - read -r -d '' petitboot_version < ${petitboot_path} - petitboot_version="$(echo ${petitboot_version//v})" - major_version="$(echo ${petitboot_version} | cut -d . -f1)" - minor_version="$(echo ${petitboot_version} | cut -d . -f2)" - - if test -z ${petitboot_version} || test ${major_version} -lt 1 || \ - test ${major_version} -eq 1 -a ${minor_version} -lt 8; then - RUN_MKCONFIG=true - fi - else - RUN_MKCONFIG=true - fi + RUN_MKCONFIG=true fi if [[ $DISABLE_BLS = "true" ]]; then diff --git a/grub2.spec b/grub2.spec index 3ed24660..55879ec3 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 16%{?dist} +Release: 17%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Wed Nov 27 2024 Marta Lewandowska - 2.12-17 +- 99-grub-mkconfig.install: on PPC systems, remove petiboot's version checks + * Wed Nov 27 2024 Marta Lewandowska - 2.12-16 - 99-grub-mkconfig.install: Disable BLS and run grub2-mkconfig when GRUB_ENABLE_BLSCFG is disable - Resolves: #2325960 From 4c3a62abb4267cf3dc40996704de6ce789343fa7 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Thu, 27 Feb 2025 12:59:56 -0600 Subject: [PATCH 03/10] Add Several CVE fixes Resolves: CVE-2024-45781 CVE-2024-45783 CVE-2024-45778 Resolves: CVE-2024-45775 CVE-2024-45780 CVE-2024-45774 Resolves: CVE-2025-0690 CVE-2025-1118 CVE-2024-45782 Resolves: CVE-2025-0624 CVE-2024-45779 CVE-2024-45776 Resolves: CVE-2025-0622 CVE-2025-0677 Signed-off-by: Leo Sandoval --- 0284-misc-Implement-grub_strlcpy.patch | 65 +++ 0285-fs-ufs-Fix-a-heap-OOB-write.patch | 31 + ...Fix-stack-OOB-write-with-grub_strcpy.patch | 31 + ...itialize-name-in-grub_cpio_find_file.patch | 40 ++ ...ger-overflow-leads-to-heap-OOB-write.patch | 89 +++ ...f2fs-Set-a-grub_errno-if-mount-fails.patch | 31 + ...plus-Set-a-grub_errno-if-mount-fails.patch | 35 ++ ...9660-Set-a-grub_errno-if-mount-fails.patch | 33 ++ 0292-fs-iso9660-Fix-invalid-free.patch | 50 ++ 0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch | 63 ++ ...ead-caused-by-invalid-dir-slot-index.patch | 64 +++ ...40-bits-offset-and-address-for-a-dat.patch | 128 +++++ ...ent-signed-unsigned-types-usage-in-r.patch | 85 +++ ...ut-of-bounds-read-for-inline-extents.patch | 46 ++ 0298-fs-ntfs-Fix-out-of-bounds-read.patch | 47 ++ ...-the-end-of-the-MFT-attribute-buffer.patch | 141 +++++ ...helper-function-to-access-attributes.patch | 183 ++++++ ...tfs-Implement-attribute-verification.patch | 245 ++++++++ 0302-fs-xfs-Fix-out-of-bounds-read.patch | 43 ++ ...g-failing-to-mount-sets-a-grub_errno.patch | 42 ++ 0304-kern-file-Ensure-file-data-is-set.patch | 32 ++ ...lement-filesystem-reference-counting.patch | 440 ++++++++++++++ ...ld-option-to-block-command-line-inte.patch | 366 ++++++++++++ ...Require-authentication-after-TPM-unl.patch | 337 +++++++++++ ...-Reference-tracking-for-the-loopback.patch | 108 ++++ 0309-kern-disk-Limit-recursion-depth.patch | 120 ++++ ...tion-Limit-recursion-in-part_iterate.patch | 44 ++ ...pt-execute-Limit-the-recursion-depth.patch | 55 ++ ...et_default_ip-and-net_default_mac-va.patch | 29 + ...bles-hooks-when-interface-is-unregis.patch | 84 +++ ...write-in-grub_net_search_config_file.patch | 79 +++ ...x-stack-buffer-overflow-in-tftp_open.patch | 115 ++++ ...eg-Do-not-permit-duplicate-SOF0-mark.patch | 33 ++ ...r-an-integer-overflow-in-grub_dl_ref.patch | 138 +++++ ...r-the-SHF_INFO_LINK-flag-in-grub_dl_.patch | 34 ++ ...-Missing-check-for-failed-allocation.patch | 34 ++ 0320-commands-ls-Fix-NULL-dereference.patch | 32 ++ ...egister-the-check_signatures-hooks-o.patch | 31 + ...ove-variables-hooks-on-module-unload.patch | 37 ++ ...ove-variables-hooks-on-module-unload.patch | 34 ++ ...overflow-leads-to-heap-OOB-write-or-.patch | 35 ++ ...ger-overflow-leads-to-heap-OOB-write.patch | 53 ++ ...x-an-integer-overflow-when-supplying.patch | 69 +++ ...ack-overflow-due-to-unlimited-recurs.patch | 83 +++ ...-Block-the-dump-command-in-lockdown-.patch | 33 ++ ...isable-memory-reading-in-lockdown-mo.patch | 50 ++ ...-Disable-memory-reading-in-lockdown-.patch | 37 ++ 0331-fs-bfs-Disable-under-lockdown.patch | 52 ++ ...able-many-filesystems-under-lockdown.patch | 391 +++++++++++++ ...afe-math-macros-to-prevent-overflows.patch | 543 ++++++++++++++++++ ...rflows-when-allocating-memory-for-ar.patch | 38 ++ ...turned-pointer-for-allocated-memory-.patch | 152 +++++ ...disk-Call-grub_ieee1275_close-when-g.patch | 31 + ...afe-math-macros-to-prevent-overflows.patch | 353 ++++++++++++ ...lows-when-allocating-memory-for-arra.patch | 82 +++ ...lows-when-assigning-returned-values-.patch | 105 ++++ ...afe-math-macros-to-prevent-overflows.patch | 138 +++++ ...verflows-when-allocating-memory-for-.patch | 40 ++ ...returned-pointer-for-allocated-memor.patch | 88 +++ ...ng-NULL-check-after-grub_strdup-call.patch | 24 + ...afe-math-macros-to-prevent-overflows.patch | 240 ++++++++ ...flows-when-allocating-memory-for-arr.patch | 45 ++ ...urned-pointer-for-allocated-memory-i.patch | 31 + ...fs-Check-if-allocated-memory-is-NULL.patch | 32 ++ ...ix-potential-underflow-and-NULL-dere.patch | 32 ++ ...unix-getroot-Fix-potential-underflow.patch | 35 ++ ...e-consistent-overflow-error-messages.patch | 55 ++ ...ine-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch | 30 + ...safe-math-to-avoid-an-integer-overfl.patch | 41 ++ ...dd-sanity-check-after-grub_strtoul-c.patch | 46 ++ ...sanity-check-after-grub_strtoul-call.patch | 57 ++ ...nux-Cast-left-shift-to-grub_uint32_t.patch | 30 + ...bsd-Use-safe-math-to-avoid-underflow.patch | 56 ++ grub.patches | 73 +++ grub2.spec | 10 +- 75 files changed, 6883 insertions(+), 1 deletion(-) create mode 100644 0284-misc-Implement-grub_strlcpy.patch create mode 100644 0285-fs-ufs-Fix-a-heap-OOB-write.patch create mode 100644 0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch create mode 100644 0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch create mode 100644 0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch create mode 100644 0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch create mode 100644 0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch create mode 100644 0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch create mode 100644 0292-fs-iso9660-Fix-invalid-free.patch create mode 100644 0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch create mode 100644 0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch create mode 100644 0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch create mode 100644 0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch create mode 100644 0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch create mode 100644 0298-fs-ntfs-Fix-out-of-bounds-read.patch create mode 100644 0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch create mode 100644 0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch create mode 100644 0301-fs-ntfs-Implement-attribute-verification.patch create mode 100644 0302-fs-xfs-Fix-out-of-bounds-read.patch create mode 100644 0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch create mode 100644 0304-kern-file-Ensure-file-data-is-set.patch create mode 100644 0305-kern-file-Implement-filesystem-reference-counting.patch create mode 100644 0306-cli_lock-Add-build-option-to-block-command-line-inte.patch create mode 100644 0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch create mode 100644 0308-disk-loopback-Reference-tracking-for-the-loopback.patch create mode 100644 0309-kern-disk-Limit-recursion-depth.patch create mode 100644 0310-kern-partition-Limit-recursion-in-part_iterate.patch create mode 100644 0311-script-execute-Limit-the-recursion-depth.patch create mode 100644 0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch create mode 100644 0313-net-Remove-variables-hooks-when-interface-is-unregis.patch create mode 100644 0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch create mode 100644 0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch create mode 100644 0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch create mode 100644 0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch create mode 100644 0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch create mode 100644 0319-commands-extcmd-Missing-check-for-failed-allocation.patch create mode 100644 0320-commands-ls-Fix-NULL-dereference.patch create mode 100644 0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch create mode 100644 0322-normal-Remove-variables-hooks-on-module-unload.patch create mode 100644 0323-gettext-Remove-variables-hooks-on-module-unload.patch create mode 100644 0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch create mode 100644 0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch create mode 100644 0326-commands-read-Fix-an-integer-overflow-when-supplying.patch create mode 100644 0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch create mode 100644 0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch create mode 100644 0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch create mode 100644 0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch create mode 100644 0331-fs-bfs-Disable-under-lockdown.patch create mode 100644 0332-fs-Disable-many-filesystems-under-lockdown.patch create mode 100644 0333-disk-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch create mode 100644 0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch create mode 100644 0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch create mode 100644 0337-fs-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch create mode 100644 0339-fs-Prevent-overflows-when-assigning-returned-values-.patch create mode 100644 0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch create mode 100644 0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch create mode 100644 0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch create mode 100644 0344-net-Use-safe-math-macros-to-prevent-overflows.patch create mode 100644 0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch create mode 100644 0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch create mode 100644 0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch create mode 100644 0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch create mode 100644 0349-osdep-unix-getroot-Fix-potential-underflow.patch create mode 100644 0350-misc-Ensure-consistent-overflow-error-messages.patch create mode 100644 0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch create mode 100644 0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch create mode 100644 0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch create mode 100644 0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch create mode 100644 0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch create mode 100644 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch diff --git a/0284-misc-Implement-grub_strlcpy.patch b/0284-misc-Implement-grub_strlcpy.patch new file mode 100644 index 00000000..d6932f2e --- /dev/null +++ b/0284-misc-Implement-grub_strlcpy.patch @@ -0,0 +1,65 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sat, 15 Jun 2024 02:33:08 +0100 +Subject: [PATCH] misc: Implement grub_strlcpy() + +grub_strlcpy() acts the same way as strlcpy() does on most *NIX, +returning the length of src and ensuring dest is always NUL +terminated except when size is 0. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/include/grub/misc.h b/include/grub/misc.h +index db517acd5..6b1e084af 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -72,6 +72,45 @@ grub_stpcpy (char *dest, const char *src) + return d - 1; + } + ++static inline grub_size_t ++grub_strlcpy (char *dest, const char *src, grub_size_t size) ++{ ++ char *d = dest; ++ grub_size_t res = 0; ++ /* ++ * We do not subtract one from size here to avoid dealing with underflowing ++ * the value, which is why to_copy is always checked to be greater than one ++ * throughout this function. ++ */ ++ grub_size_t to_copy = size; ++ ++ /* Copy size - 1 bytes to dest. */ ++ if (to_copy > 1) ++ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1) ++ ; ++ ++ /* ++ * NUL terminate if size != 0. The previous step may have copied a NUL byte ++ * if it reached the end of the string, but we know dest[size - 1] must always ++ * be a NUL byte. ++ */ ++ if (size != 0) ++ dest[size - 1] = '\0'; ++ ++ /* If there is still space in dest, but are here, we reached the end of src. */ ++ if (to_copy > 1) ++ return res; ++ ++ /* ++ * If we haven't reached the end of the string, iterate through to determine ++ * the strings total length. ++ */ ++ while (*src++ != '\0' && ++res) ++ ; ++ ++ return res; ++} ++ + /* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */ + static inline void * + grub_memcpy (void *dest, const void *src, grub_size_t n) diff --git a/0285-fs-ufs-Fix-a-heap-OOB-write.patch b/0285-fs-ufs-Fix-a-heap-OOB-write.patch new file mode 100644 index 00000000..ed1be4cb --- /dev/null +++ b/0285-fs-ufs-Fix-a-heap-OOB-write.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:03:33 +0100 +Subject: [PATCH] fs/ufs: Fix a heap OOB write + +grub_strcpy() was used to copy a symlink name from the filesystem +image to a heap allocated buffer. This led to a OOB write to adjacent +heap allocations. Fix by using grub_strlcpy(). + +Fixes: CVE-2024-45781 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ufs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index a354c92d9..01235101b 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino) + /* Check against zero is paylindromic, no need to swap. */ + if (data->inode.nblocks == 0 + && INODE_SIZE (data) <= sizeof (data->inode.symlink)) +- grub_strcpy (symlink, (char *) data->inode.symlink); ++ grub_strlcpy (symlink, (char *) data->inode.symlink, sz); + else + { + if (grub_ufs_read_file (data, 0, 0, 0, sz, symlink) < 0) diff --git a/0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch b/0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch new file mode 100644 index 00000000..5a836725 --- /dev/null +++ b/0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:48:33 +0100 +Subject: [PATCH] fs/hfs: Fix stack OOB write with grub_strcpy() + +Replaced with grub_strlcpy(). + +Fixes: CVE-2024-45782 +Fixes: CVE-2024-56737 +Fixes: https://savannah.gnu.org/bugs/?66599 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/hfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index 91dc0e69c..920112b03 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk) + volume name. */ + key.parent_dir = grub_cpu_to_be32_compile_time (1); + key.strlen = data->sblock.volname[0]; +- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1)); ++ grub_strlcpy ((char *) key.str, (char *) (data->sblock.volname + 1), sizeof (key.str)); + + if (grub_hfs_find_node (data, (char *) &key, data->cat_root, + 0, (char *) &dir, sizeof (dir)) == 0) diff --git a/0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch b/0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch new file mode 100644 index 00000000..6433d2d5 --- /dev/null +++ b/0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 02:47:54 +0100 +Subject: [PATCH] fs/tar: Initialize name in grub_cpio_find_file() + +It was possible to iterate through grub_cpio_find_file() without +allocating name and not setting mode to GRUB_ARCHELP_ATTR_END, which +would cause the uninitialized value for name to be used as an argument +for canonicalize() in grub_archelp_dir(). + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/tar.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index c551ed6b5..646bce5eb 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -78,6 +78,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + int reread = 0, have_longname = 0, have_longlink = 0; + + data->hofs = data->next_hofs; ++ *name = NULL; + + for (reread = 0; reread < 3; reread++) + { +@@ -202,6 +203,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + } + return GRUB_ERR_NONE; + } ++ ++ if (*name == NULL) ++ return grub_error (GRUB_ERR_BAD_FS, "invalid tar archive"); ++ + return GRUB_ERR_NONE; + } + diff --git a/0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch b/0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch new file mode 100644 index 00000000..b059e496 --- /dev/null +++ b/0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch @@ -0,0 +1,89 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:58 +0000 +Subject: [PATCH] fs/tar: Integer overflow leads to heap OOB write + +Both namesize and linksize are derived from hd.size, a 12-digit octal +number parsed by read_number(). Later direct arithmetic calculation like +"namesize + 1" and "linksize + 1" may exceed the maximum value of +grub_size_t leading to heap OOB write. This patch fixes the issue by +using grub_add() and checking for an overflow. + +Fixes: CVE-2024-45780 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/tar.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 646bce5eb..386c09022 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -76,6 +77,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + struct head hd; + int reread = 0, have_longname = 0, have_longlink = 0; ++ grub_size_t sz; + + data->hofs = data->next_hofs; + *name = NULL; +@@ -98,7 +100,11 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + grub_err_t err; + grub_size_t namesize = read_number (hd.size, sizeof (hd.size)); +- *name = grub_malloc (namesize + 1); ++ ++ if (grub_add (namesize, 1, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow")); ++ ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + err = grub_disk_read (data->disk, 0, +@@ -118,15 +124,19 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + { + grub_err_t err; + grub_size_t linksize = read_number (hd.size, sizeof (hd.size)); +- if (data->linkname_alloc < linksize + 1) ++ ++ if (grub_add (linksize, 1, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow")); ++ ++ if (data->linkname_alloc < sz) + { + char *n; +- n = grub_calloc (2, linksize + 1); ++ n = grub_calloc (2, sz); + if (!n) + return grub_errno; + grub_free (data->linkname); + data->linkname = n; +- data->linkname_alloc = 2 * (linksize + 1); ++ data->linkname_alloc = 2 * (sz); + } + + err = grub_disk_read (data->disk, 0, +@@ -149,7 +159,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + while (extra_size < sizeof (hd.prefix) + && hd.prefix[extra_size]) + extra_size++; +- *name = grub_malloc (sizeof (hd.name) + extra_size + 2); ++ ++ if (grub_add (sizeof (hd.name) + 2, extra_size, &sz)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("long name size overflow")); ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + if (hd.prefix[0]) diff --git a/0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch b/0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 00000000..0b72b727 --- /dev/null +++ b/0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:15:03 +0100 +Subject: [PATCH] fs/f2fs: Set a grub_errno if mount fails + +It was previously possible for grub_errno to not be set when +grub_f2fs_mount() failed if nat_bitmap_ptr() returned NULL. + +This issue is solved by ensuring a grub_errno is set in the fail case. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/f2fs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index 855e24618..db8a65f8d 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -872,6 +872,9 @@ grub_f2fs_mount (grub_disk_t disk) + return data; + + fail: ++ if (grub_errno == GRUB_ERR_NONE) ++ grub_error (GRUB_ERR_BAD_FS, "not a F2FS filesystem"); ++ + grub_free (data); + + return NULL; diff --git a/0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch b/0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 00000000..eb36c019 --- /dev/null +++ b/0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:22:51 +0100 +Subject: [PATCH] fs/hfsplus: Set a grub_errno if mount fails + +It was possible for mount to fail but not set grub_errno. This led to +a possible double decrement of the module reference count if the NULL +page was mapped. + +Fixing in general as a similar bug was fixed in commit 61b13c187 +(fs/hfsplus: Set grub_errno to prevent NULL pointer access) and there +are likely more variants around. + +Fixes: CVE-2024-45783 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/hfsplus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index 295822f69..de71fd486 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -405,7 +405,7 @@ grub_hfsplus_mount (grub_disk_t disk) + + fail: + +- if (grub_errno == GRUB_ERR_OUT_OF_RANGE) ++ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE) + grub_error (GRUB_ERR_BAD_FS, "not a HFS+ filesystem"); + + grub_free (data); diff --git a/0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch b/0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch new file mode 100644 index 00000000..69470f69 --- /dev/null +++ b/0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:37:08 +0100 +Subject: [PATCH] fs/iso9660: Set a grub_errno if mount fails + +It was possible for a grub_errno to not be set if mount of an ISO 9660 +filesystem failed when set_rockridge() returned 0. + +This isn't known to be exploitable as the other filesystems due to +filesystem helper checking the requested file type. Though fixing +as a precaution. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/iso9660.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 8c348b59a..8d480e602 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -551,6 +551,9 @@ grub_iso9660_mount (grub_disk_t disk) + return data; + + fail: ++ if (grub_errno == GRUB_ERR_NONE) ++ grub_error (GRUB_ERR_BAD_FS, "not a ISO9660 filesystem"); ++ + grub_free (data); + return 0; + } diff --git a/0292-fs-iso9660-Fix-invalid-free.patch b/0292-fs-iso9660-Fix-invalid-free.patch new file mode 100644 index 00000000..61bd5cce --- /dev/null +++ b/0292-fs-iso9660-Fix-invalid-free.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:42 +0800 +Subject: [PATCH] fs/iso9660: Fix invalid free + +The ctx->filename can point to either a string literal or a dynamically +allocated string. The ctx->filename_alloc field is used to indicate the +type of allocation. + +An issue has been identified where ctx->filename is reassigned to +a string literal in susp_iterate_dir() but ctx->filename_alloc is not +correctly handled. This oversight causes a memory leak and an invalid +free operation later. + +The fix involves checking ctx->filename_alloc, freeing the allocated +string if necessary and clearing ctx->filename_alloc for string literals. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/iso9660.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 8d480e602..8e3c95c4f 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -628,9 +628,19 @@ susp_iterate_dir (struct grub_iso9660_susp_entry *entry, + filename type is stored. */ + /* FIXME: Fix this slightly improper cast. */ + if (entry->data[0] & GRUB_ISO9660_RR_DOT) +- ctx->filename = (char *) "."; ++ { ++ if (ctx->filename_alloc) ++ grub_free (ctx->filename); ++ ctx->filename_alloc = 0; ++ ctx->filename = (char *) "."; ++ } + else if (entry->data[0] & GRUB_ISO9660_RR_DOTDOT) +- ctx->filename = (char *) ".."; ++ { ++ if (ctx->filename_alloc) ++ grub_free (ctx->filename); ++ ctx->filename_alloc = 0; ++ ctx->filename = (char *) ".."; ++ } + else if (entry->len >= 5) + { + grub_size_t off = 0, csize = 1; diff --git a/0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch b/0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch new file mode 100644 index 00000000..49464e74 --- /dev/null +++ b/0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch @@ -0,0 +1,63 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:59 +0000 +Subject: [PATCH] fs/jfs: Fix OOB read in jfs_getent() + +The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash +was caused by an invalid leaf nodes count, diro->dirpage->header.count, +which was larger than the maximum number of leaf nodes allowed in an +inode. This fix is to ensure that the leaf nodes count is validated in +grub_jfs_opendir() before calling grub_jfs_getent(). + +On the occasion replace existing raw numbers with newly defined constant. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/jfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 6f7c43904..32dec7fb7 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -41,6 +41,12 @@ GRUB_MOD_LICENSE ("GPLv3+"); + + #define GRUB_JFS_TREE_LEAF 2 + ++/* ++ * Define max entries stored in-line in an inode. ++ * https://jfs.sourceforge.net/project/pub/jfslayout.pdf ++ */ ++#define GRUB_JFS_INODE_INLINE_ENTRIES 8 ++ + struct grub_jfs_sblock + { + /* The magic for JFS. It should contain the string "JFS1". */ +@@ -203,9 +209,9 @@ struct grub_jfs_inode + grub_uint8_t freecnt; + grub_uint8_t freelist; + grub_uint32_t idotdot; +- grub_uint8_t sorted[8]; ++ grub_uint8_t sorted[GRUB_JFS_INODE_INLINE_ENTRIES]; + } header; +- struct grub_jfs_leaf_dirent dirents[8]; ++ struct grub_jfs_leaf_dirent dirents[GRUB_JFS_INODE_INLINE_ENTRIES]; + } GRUB_PACKED dir; + /* Fast symlink. */ + struct +@@ -453,6 +459,13 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + /* Check if the entire tree is contained within the inode. */ + if (inode->file.tree.flags & GRUB_JFS_TREE_LEAF) + { ++ if (inode->dir.header.count > GRUB_JFS_INODE_INLINE_ENTRIES) ++ { ++ grub_free (diro); ++ grub_error (GRUB_ERR_BAD_FS, N_("invalid JFS inode")); ++ return 0; ++ } ++ + diro->leaf = inode->dir.dirents; + diro->next_leaf = (struct grub_jfs_leaf_next_dirent *) de; + diro->sorted = inode->dir.header.sorted; diff --git a/0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch b/0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch new file mode 100644 index 00000000..029e8485 --- /dev/null +++ b/0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch @@ -0,0 +1,64 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:28:00 +0000 +Subject: [PATCH] fs/jfs: Fix OOB read caused by invalid dir slot index + +While fuzz testing JFS with ASAN enabled an OOB read was detected in +grub_jfs_opendir(). The issue occurred due to an invalid directory slot +index in the first entry of the sorted directory slot array in the inode +directory header. The fix ensures the slot index is validated before +accessing it. Given that an internal or a leaf node in a directory B+ +tree is a 4 KiB in size and each directory slot is always 32 bytes, the +max number of slots in a node is 128. The validation ensures that the +slot index doesn't exceed this limit. + +[1] https://jfs.sourceforge.net/project/pub/jfslayout.pdf + + JFS will allocate 4K of disk space for an internal node of the B+ tree. + An internal node looks the same as a leaf node. + - page 10 + + Fixed number of Directory Slots depending on the size of the node. These are + the slots to be used for storing the directory slot array and the directory + entries or router entries. A directory slot is always 32 bytes. + ... + A Directory Slot Array which is a sorted array of indices to the directory + slots that are currently in use. + ... + An internal or a leaf node in the directory B+ tree is a 4K page. + - page 25 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/fs/jfs.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 32dec7fb7..88fb884df 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -46,6 +46,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); + * https://jfs.sourceforge.net/project/pub/jfslayout.pdf + */ + #define GRUB_JFS_INODE_INLINE_ENTRIES 8 ++#define GRUB_JFS_DIR_MAX_SLOTS 128 + + struct grub_jfs_sblock + { +@@ -481,6 +482,14 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + return 0; + } + ++ if (inode->dir.header.sorted[0] >= GRUB_JFS_DIR_MAX_SLOTS) ++ { ++ grub_error (GRUB_ERR_BAD_FS, N_("invalid directory slot index")); ++ grub_free (diro->dirpage); ++ grub_free (diro); ++ return 0; ++ } ++ + blk = grub_le_to_cpu32 (de[inode->dir.header.sorted[0]].ex.blk2); + blk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS); + diff --git a/0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch b/0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch new file mode 100644 index 00000000..ed387aeb --- /dev/null +++ b/0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch @@ -0,0 +1,128 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:39 +0000 +Subject: [PATCH] fs/jfs: Use full 40 bits offset and address for a data extent + +An extent's logical offset and address are represented as a 40-bit value +split into two parts: the most significant 8 bits and the least +significant 32 bits. Currently the JFS code uses only the least +significant 32 bits value for offsets and addresses assuming the data +size will never exceed the 32-bit range. This approach ignores the most +significant 8 bits potentially leading to incorrect offsets and +addresses for larger values. The patch fixes it by incorporating the +most significant 8 bits into the calculation to get the full 40-bits +value for offsets and addresses. + +https://jfs.sourceforge.net/project/pub/jfslayout.pdf + + "off1,off2 is a 40-bit field, containing the logical offset of the first + block in the extent. + ... + addr1,addr2 is a 40-bit field, containing the address of the extent." + +Signed-off-by: Lidong Chen +Reviewed-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/jfs.c | 41 +++++++++++++++++++++++++++++------------ + 1 file changed, 29 insertions(+), 12 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 88fb884df..2bde48d45 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -265,6 +265,20 @@ static grub_dl_t my_mod; + + static grub_err_t grub_jfs_lookup_symlink (struct grub_jfs_data *data, grub_uint32_t ino); + ++/* ++ * An extent's offset, physical and logical, is represented as a 40-bit value. ++ * This 40-bit value is split into two parts: ++ * - offset1: the most signficant 8 bits of the offset, ++ * - offset2: the least significant 32 bits of the offset. ++ * ++ * This function calculates and returns the 64-bit offset of an extent. ++ */ ++static grub_uint64_t ++get_ext_offset (grub_uint8_t offset1, grub_uint32_t offset2) ++{ ++ return (((grub_uint64_t) offset1 << 32) | grub_le_to_cpu32 (offset2)); ++} ++ + static grub_int64_t + getblk (struct grub_jfs_treehead *treehead, + struct grub_jfs_tree_extent *extents, +@@ -274,22 +288,25 @@ getblk (struct grub_jfs_treehead *treehead, + { + int found = -1; + int i; ++ grub_uint64_t ext_offset, ext_blk; + + for (i = 0; i < grub_le_to_cpu16 (treehead->count) - 2 && + i < max_extents; i++) + { ++ ext_offset = get_ext_offset (extents[i].offset1, extents[i].offset2); ++ ext_blk = get_ext_offset (extents[i].extent.blk1, extents[i].extent.blk2); ++ + if (treehead->flags & GRUB_JFS_TREE_LEAF) + { + /* Read the leafnode. */ +- if (grub_le_to_cpu32 (extents[i].offset2) <= blk ++ if (ext_offset <= blk + && ((grub_le_to_cpu16 (extents[i].extent.length)) + + (extents[i].extent.length2 << 16) +- + grub_le_to_cpu32 (extents[i].offset2)) > blk) +- return (blk - grub_le_to_cpu32 (extents[i].offset2) +- + grub_le_to_cpu32 (extents[i].extent.blk2)); ++ + ext_offset) > blk) ++ return (blk - ext_offset + ext_blk); + } + else +- if (blk >= grub_le_to_cpu32 (extents[i].offset2)) ++ if (blk >= ext_offset) + found = i; + } + +@@ -307,10 +324,9 @@ getblk (struct grub_jfs_treehead *treehead, + return -1; + + if (!grub_disk_read (data->disk, +- ((grub_disk_addr_t) grub_le_to_cpu32 (extents[found].extent.blk2)) +- << (grub_le_to_cpu16 (data->sblock.log2_blksz) +- - GRUB_DISK_SECTOR_BITS), 0, +- sizeof (*tree), (char *) tree)) ++ (grub_disk_addr_t) ext_blk ++ << (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS), ++ 0, sizeof (*tree), (char *) tree)) + { + if (grub_memcmp (&tree->treehead, treehead, sizeof (struct grub_jfs_treehead)) || + grub_memcmp (&tree->extents, extents, 254 * sizeof (struct grub_jfs_tree_extent))) +@@ -361,7 +377,7 @@ grub_jfs_read_inode (struct grub_jfs_data *data, grub_uint32_t ino, + sizeof (iag_inodes), &iag_inodes)) + return grub_errno; + +- inoblk = grub_le_to_cpu32 (iag_inodes[inoext].blk2); ++ inoblk = get_ext_offset (iag_inodes[inoext].blk1, iag_inodes[inoext].blk2); + inoblk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) + - GRUB_DISK_SECTOR_BITS); + inoblk += inonum; +@@ -490,7 +506,8 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + return 0; + } + +- blk = grub_le_to_cpu32 (de[inode->dir.header.sorted[0]].ex.blk2); ++ blk = get_ext_offset (de[inode->dir.header.sorted[0]].ex.blk1, ++ de[inode->dir.header.sorted[0]].ex.blk2); + blk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS); + + /* Read in the nodes until we are on the leaf node level. */ +@@ -508,7 +525,7 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) + + de = (struct grub_jfs_internal_dirent *) diro->dirpage->dirent; + index = diro->dirpage->sorted[diro->dirpage->header.sindex * 32]; +- blk = (grub_le_to_cpu32 (de[index].ex.blk2) ++ blk = (get_ext_offset (de[index].ex.blk1, de[index].ex.blk2) + << (grub_le_to_cpu16 (data->sblock.log2_blksz) + - GRUB_DISK_SECTOR_BITS)); + } while (!(diro->dirpage->header.flags & GRUB_JFS_TREE_LEAF)); diff --git a/0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch b/0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch new file mode 100644 index 00000000..33c684b2 --- /dev/null +++ b/0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch @@ -0,0 +1,85 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:40 +0000 +Subject: [PATCH] fs/jfs: Inconsistent signed/unsigned types usage in return + values + +The getblk() returns a value of type grub_int64_t which is assigned to +iagblk and inoblk, both of type grub_uint64_t, in grub_jfs_read_inode() +via grub_jfs_blkno(). This patch fixes the type mismatch in the +functions. Additionally, the getblk() will return 0 instead of -1 on +failure cases. This change is safe because grub_errno is always set in +getblk() to indicate errors and it is later checked in the callers. + +Signed-off-by: Lidong Chen +Reviewed-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/jfs.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 2bde48d45..70a2f4947 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -279,7 +279,7 @@ get_ext_offset (grub_uint8_t offset1, grub_uint32_t offset2) + return (((grub_uint64_t) offset1 << 32) | grub_le_to_cpu32 (offset2)); + } + +-static grub_int64_t ++static grub_uint64_t + getblk (struct grub_jfs_treehead *treehead, + struct grub_jfs_tree_extent *extents, + int max_extents, +@@ -290,6 +290,8 @@ getblk (struct grub_jfs_treehead *treehead, + int i; + grub_uint64_t ext_offset, ext_blk; + ++ grub_errno = GRUB_ERR_NONE; ++ + for (i = 0; i < grub_le_to_cpu16 (treehead->count) - 2 && + i < max_extents; i++) + { +@@ -312,7 +314,7 @@ getblk (struct grub_jfs_treehead *treehead, + + if (found != -1) + { +- grub_int64_t ret = -1; ++ grub_uint64_t ret = 0; + struct + { + struct grub_jfs_treehead treehead; +@@ -321,7 +323,7 @@ getblk (struct grub_jfs_treehead *treehead, + + tree = grub_zalloc (sizeof (*tree)); + if (!tree) +- return -1; ++ return 0; + + if (!grub_disk_read (data->disk, + (grub_disk_addr_t) ext_blk +@@ -334,19 +336,20 @@ getblk (struct grub_jfs_treehead *treehead, + else + { + grub_error (GRUB_ERR_BAD_FS, "jfs: infinite recursion detected"); +- ret = -1; ++ ret = 0; + } + } + grub_free (tree); + return ret; + } + +- return -1; ++ grub_error (GRUB_ERR_READ_ERROR, "jfs: block %" PRIuGRUB_UINT64_T " not found", blk); ++ return 0; + } + + /* Get the block number for the block BLK in the node INODE in the + mounted filesystem DATA. */ +-static grub_int64_t ++static grub_uint64_t + grub_jfs_blkno (struct grub_jfs_data *data, struct grub_jfs_inode *inode, + grub_uint64_t blk) + { diff --git a/0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch b/0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch new file mode 100644 index 00000000..880ef764 --- /dev/null +++ b/0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:23 +0800 +Subject: [PATCH] fs/ext2: Fix out-of-bounds read for inline extents + +When inline extents are used, i.e. the extent tree depth equals zero, +a maximum of four entries can fit into the inode's data block. If the +extent header states a number of entries greater than four the current +ext2 implementation causes an out-of-bounds read. Fix this issue by +capping the number of extents to four when reading inline extents. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ext2.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index e1cc5e62a..3f9f6b208 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -495,6 +495,8 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + struct grub_ext4_extent *ext; + int i; + grub_disk_addr_t ret; ++ grub_uint16_t nent; ++ const grub_uint16_t max_inline_ext = sizeof (inode->blocks) / sizeof (*ext) - 1; /* Minus 1 extent header. */ + + if (grub_ext4_find_leaf (data, (struct grub_ext4_extent_header *) inode->blocks.dir_blocks, + fileblock, &leaf) != GRUB_ERR_NONE) +@@ -508,7 +510,13 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + return 0; + + ext = (struct grub_ext4_extent *) (leaf + 1); +- for (i = 0; i < grub_le_to_cpu16 (leaf->entries); i++) ++ ++ nent = grub_le_to_cpu16 (leaf->entries); ++ ++ if (leaf->depth == 0) ++ nent = grub_min (nent, max_inline_ext); ++ ++ for (i = 0; i < nent; i++) + { + if (fileblock < grub_le_to_cpu32 (ext[i].block)) + break; diff --git a/0298-fs-ntfs-Fix-out-of-bounds-read.patch b/0298-fs-ntfs-Fix-out-of-bounds-read.patch new file mode 100644 index 00000000..4d4acdce --- /dev/null +++ b/0298-fs-ntfs-Fix-out-of-bounds-read.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Mon, 3 Jun 2024 12:12:06 +0800 +Subject: [PATCH] fs/ntfs: Fix out-of-bounds read + +When parsing NTFS file records the presence of the 0xFF marker indicates +the end of the attribute list. This value signifies that there are no +more attributes to process. + +However, when the end marker is missing due to corrupted metadata the +loop continues to read beyond the attribute list resulting in out-of-bounds +reads and potentially entering an infinite loop. + +This patch adds a check to provide a stop condition for the loop ensuring +it stops at the end of the attribute list or at the end of the Master File +Table. This guards against out-of-bounds reads and prevents infinite loops. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index de435aa14..8a5384247 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -139,6 +139,8 @@ free_attr (struct grub_ntfs_attr *at) + static grub_uint8_t * + find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + { ++ grub_uint8_t *mft_end; ++ + if (at->flags & GRUB_NTFS_AF_ALST) + { + retry: +@@ -191,7 +193,8 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + return NULL; + } + at->attr_cur = at->attr_nxt; +- while (*at->attr_cur != 0xFF) ++ mft_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); ++ while (at->attr_cur < mft_end && *at->attr_cur != 0xFF) + { + at->attr_nxt += u16at (at->attr_cur, 4); + if (*at->attr_cur == GRUB_NTFS_AT_ATTRIBUTE_LIST) diff --git a/0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch b/0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch new file mode 100644 index 00000000..e6a5c144 --- /dev/null +++ b/0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch @@ -0,0 +1,141 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 7 Jan 2025 11:38:34 +0000 +Subject: [PATCH] fs/ntfs: Track the end of the MFT attribute buffer + +The end of the attribute buffer should be stored alongside the rest of +the attribute struct as right now it is not possible to implement bounds +checking when accessing attributes sequentially. + +This is done via: + - updating init_attr() to set at->end and check is is not initially out of bounds, + - implementing checks as init_attr() had its type change in its callers, + - updating the value of at->end when needed. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 34 ++++++++++++++++++++++++++++------ + include/grub/ntfs.h | 1 + + 2 files changed, 29 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 8a5384247..dbda720e1 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -119,13 +119,20 @@ static grub_err_t read_data (struct grub_ntfs_attr *at, grub_uint8_t *pa, + grub_disk_read_hook_t read_hook, + void *read_hook_data); + +-static void ++static grub_err_t + init_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft) + { + at->mft = mft; + at->flags = (mft == &mft->data->mmft) ? GRUB_NTFS_AF_MMFT : 0; + at->attr_nxt = mft->buf + first_attr_off (mft->buf); ++ at->end = mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR); ++ ++ if (at->attr_nxt > at->end) ++ return grub_error (GRUB_ERR_BAD_FS, "attributes start outside the MFT"); ++ + at->attr_end = at->emft_buf = at->edat_buf = at->sbuf = NULL; ++ ++ return GRUB_ERR_NONE; + } + + static void +@@ -239,6 +246,10 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + pa_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + } + at->flags |= GRUB_NTFS_AF_ALST; ++ ++ /* From this point on pa_end is the end of the buffer */ ++ at->end = pa_end; ++ + while (at->attr_nxt < at->attr_end) + { + if ((*at->attr_nxt == attr) || (attr == 0)) +@@ -298,7 +309,9 @@ locate_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft, + { + grub_uint8_t *pa; + +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return NULL; ++ + pa = find_attr (at, attr); + if (pa == NULL) + return NULL; +@@ -314,7 +327,8 @@ locate_attr (struct grub_ntfs_attr *at, struct grub_ntfs_file *mft, + } + grub_errno = GRUB_ERR_NONE; + free_attr (at); +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return NULL; + pa = find_attr (at, attr); + } + return pa; +@@ -585,7 +599,7 @@ init_file (struct grub_ntfs_file *mft, grub_uint64_t mftno) + mft->attr.attr_end = 0; /* Don't jump to attribute list */ + } + else +- init_attr (&mft->attr, mft); ++ return init_attr (&mft->attr, mft); + + return 0; + } +@@ -811,7 +825,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + bmp = NULL; + + at = &attr; +- init_attr (at, mft); ++ if (init_attr (at, mft) != GRUB_ERR_NONE) ++ return 0; ++ + while (1) + { + cur_pos = find_attr (at, GRUB_NTFS_AT_INDEX_ROOT); +@@ -842,7 +858,9 @@ grub_ntfs_iterate_dir (grub_fshelp_node_t dir, + bitmap = NULL; + bitmap_len = 0; + free_attr (at); ++ /* No need to check errors here, as it will already be fine */ + init_attr (at, mft); ++ + while ((cur_pos = find_attr (at, GRUB_NTFS_AT_BITMAP)) != NULL) + { + int ofs; +@@ -1207,6 +1225,7 @@ grub_ntfs_label (grub_device_t device, char **label) + struct grub_ntfs_data *data = 0; + struct grub_fshelp_node *mft = 0; + grub_uint8_t *pa; ++ grub_err_t err; + + grub_dl_ref (my_mod); + +@@ -1232,7 +1251,10 @@ grub_ntfs_label (grub_device_t device, char **label) + goto fail; + } + +- init_attr (&mft->attr, mft); ++ err = init_attr (&mft->attr, mft); ++ if (err != GRUB_ERR_NONE) ++ return err; ++ + pa = find_attr (&mft->attr, GRUB_NTFS_AT_VOLUME_NAME); + + if (pa >= mft->buf + (mft->data->mft_size << GRUB_NTFS_BLK_SHR)) +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index d1a6af696..ec1c4db38 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -134,6 +134,7 @@ struct grub_ntfs_attr + grub_uint8_t *attr_cur, *attr_nxt, *attr_end; + grub_uint32_t save_pos; + grub_uint8_t *sbuf; ++ grub_uint8_t *end; + struct grub_ntfs_file *mft; + }; + diff --git a/0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch b/0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch new file mode 100644 index 00000000..aede4b40 --- /dev/null +++ b/0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch @@ -0,0 +1,183 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 14 May 2024 12:39:56 +0100 +Subject: [PATCH] fs/ntfs: Use a helper function to access attributes + +Right now to access the next attribute the code reads the length of the +current attribute and adds that to the current pointer. This is error +prone as bounds checking needs to be performed all over the place. So, +implement a helper and ensure its used across find_attr() and read_attr(). + +This commit does *not* implement full bounds checking. It is just the +preparation work for this to be added into the helper. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 69 +++++++++++++++++++++++++++++++++++++++++++---------- + include/grub/ntfs.h | 2 ++ + 2 files changed, 58 insertions(+), 13 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index dbda720e1..1c678f3d0 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -70,6 +70,25 @@ res_attr_data_len (void *res_attr_ptr) + return u32at (res_attr_ptr, 0x10); + } + ++/* Return the next attribute if it exists, otherwise return NULL. */ ++static grub_uint8_t * ++next_attribute (grub_uint8_t *curr_attribute, void *end) ++{ ++ grub_uint8_t *next = curr_attribute; ++ ++ /* ++ * Need to verify we aren't exceeding the end of the buffer by reading the ++ * header for the current attribute ++ */ ++ if (curr_attribute + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) ++ return NULL; ++ ++ next += u16at (curr_attribute, 4); ++ ++ return next; ++} ++ ++ + grub_ntfscomp_func_t grub_ntfscomp_func; + + static grub_err_t +@@ -151,13 +170,13 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + if (at->flags & GRUB_NTFS_AF_ALST) + { + retry: +- while (at->attr_nxt < at->attr_end) ++ while (at->attr_nxt) + { + at->attr_cur = at->attr_nxt; +- at->attr_nxt += u16at (at->attr_cur, 4); ++ at->attr_nxt = next_attribute (at->attr_cur, at->attr_end); + if ((*at->attr_cur == attr) || (attr == 0)) + { +- grub_uint8_t *new_pos; ++ grub_uint8_t *new_pos, *end; + + if (at->flags & GRUB_NTFS_AF_MMFT) + { +@@ -181,15 +200,36 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + return NULL; + } + ++ /* ++ * Only time emft_bufs is defined is in this function, with this ++ * size. ++ */ ++ grub_size_t emft_buf_size = ++ at->mft->data->mft_size << GRUB_NTFS_BLK_SHR; ++ ++ /* ++ * Needs to be enough space for the successful case to even ++ * bother. ++ */ ++ if (first_attr_off (at->emft_buf) >= (emft_buf_size - 0x18 - 2)) ++ { ++ grub_error (GRUB_ERR_BAD_FS, ++ "can\'t find 0x%X in attribute list", ++ (unsigned char) *at->attr_cur); ++ return NULL; ++ } ++ + new_pos = &at->emft_buf[first_attr_off (at->emft_buf)]; +- while (*new_pos != 0xFF) ++ end = &at->emft_buf[emft_buf_size]; ++ ++ while (new_pos && *new_pos != 0xFF) + { + if ((*new_pos == *at->attr_cur) + && (u16at (new_pos, 0xE) == u16at (at->attr_cur, 0x18))) + { + return new_pos; + } +- new_pos += u16at (new_pos, 4); ++ new_pos = next_attribute (new_pos, end); + } + grub_error (GRUB_ERR_BAD_FS, + "can\'t find 0x%X in attribute list", +@@ -203,7 +243,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + mft_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); + while (at->attr_cur < mft_end && *at->attr_cur != 0xFF) + { +- at->attr_nxt += u16at (at->attr_cur, 4); ++ at->attr_nxt = next_attribute (at->attr_cur, at->end); + if (*at->attr_cur == GRUB_NTFS_AT_ATTRIBUTE_LIST) + at->attr_end = at->attr_cur; + if ((*at->attr_cur == attr) || (attr == 0)) +@@ -250,13 +290,14 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + /* From this point on pa_end is the end of the buffer */ + at->end = pa_end; + +- while (at->attr_nxt < at->attr_end) ++ while (at->attr_nxt) + { + if ((*at->attr_nxt == attr) || (attr == 0)) + break; +- at->attr_nxt += u16at (at->attr_nxt, 4); ++ at->attr_nxt = next_attribute (at->attr_nxt, pa_end); + } +- if (at->attr_nxt >= at->attr_end) ++ ++ if (at->attr_nxt >= at->attr_end || at->attr_nxt == NULL) + return NULL; + + if ((at->flags & GRUB_NTFS_AF_MMFT) && (attr == GRUB_NTFS_AT_DATA)) +@@ -277,7 +318,8 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + grub_cpu_to_le32 (at->mft->data->mft_start + + 1)); + pa = at->attr_nxt + u16at (pa, 4); +- while (pa < at->attr_end) ++ ++ while (pa) + { + if (*pa != attr) + break; +@@ -293,7 +335,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + u32at (pa, 0x10) * (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR), + at->mft->data->mft_size << GRUB_NTFS_BLK_SHR, 0, 0, 0)) + return NULL; +- pa += u16at (pa, 4); ++ pa = next_attribute (pa, pa_end); + } + at->attr_nxt = at->attr_cur; + at->flags &= ~GRUB_NTFS_AF_GPOS; +@@ -530,14 +572,15 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, + else + vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); + pa = at->attr_nxt + u16at (at->attr_nxt, 4); +- while (pa < at->attr_end) ++ ++ while (pa) + { + if (*pa != attr) + break; + if (u32at (pa, 8) > vcn) + break; + at->attr_nxt = pa; +- pa += u16at (pa, 4); ++ pa = next_attribute (pa, at->attr_end); + } + } + pp = find_attr (at, attr); +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index ec1c4db38..2c8078403 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -89,6 +89,8 @@ enum + #define GRUB_NTFS_COM_SEC (GRUB_NTFS_COM_LEN >> GRUB_NTFS_BLK_SHR) + #define GRUB_NTFS_LOG_COM_SEC (GRUB_NTFS_COM_LOG_LEN - GRUB_NTFS_BLK_SHR) + ++#define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 ++ + enum + { + GRUB_NTFS_AF_ALST = 1, diff --git a/0301-fs-ntfs-Implement-attribute-verification.patch b/0301-fs-ntfs-Implement-attribute-verification.patch new file mode 100644 index 00000000..4ee1c392 --- /dev/null +++ b/0301-fs-ntfs-Implement-attribute-verification.patch @@ -0,0 +1,245 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 14 May 2024 12:39:56 +0100 +Subject: [PATCH] fs/ntfs: Implement attribute verification + +It was possible to read OOB when an attribute had a size that exceeded +the allocated buffer. This resolves that by making sure all attributes +that get read are fully in the allocated space by implementing +a function to validate them. + +Defining the offsets in include/grub/ntfs.h but they are only used in +the validation function and not across the rest of the NTFS code. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 153 ++++++++++++++++++++++++++++++++++++++++++++++++++++ + include/grub/ntfs.h | 22 ++++++++ + 2 files changed, 175 insertions(+) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 1c678f3d0..64f4f2221 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -70,6 +70,149 @@ res_attr_data_len (void *res_attr_ptr) + return u32at (res_attr_ptr, 0x10); + } + ++/* ++ * Check if the attribute is valid and doesn't exceed the allocated region. ++ * This accounts for resident and non-resident data. ++ * ++ * This is based off the documentation from the linux-ntfs project: ++ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html ++ */ ++static bool ++validate_attribute (grub_uint8_t *attr, void *end) ++{ ++ grub_size_t attr_size = 0; ++ grub_size_t min_size = 0; ++ grub_size_t spare = (grub_uint8_t *) end - attr; ++ /* ++ * Just used as a temporary variable to try and deal with cases where someone ++ * tries to overlap fields. ++ */ ++ grub_size_t curr = 0; ++ ++ /* Need verify we can entirely read the attributes header. */ ++ if (attr + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) ++ goto fail; ++ ++ /* ++ * So, the rest of this code uses a 16bit int for the attribute length but ++ * from reading the all the documentation I could find it says this field is ++ * actually 32bit. But let's be consistent with the rest of the code. ++ * ++ * https://elixir.bootlin.com/linux/v6.10.7/source/fs/ntfs3/ntfs.h#L370 ++ */ ++ attr_size = u16at (attr, GRUB_NTFS_ATTRIBUTE_LENGTH); ++ ++ if (attr_size > spare) ++ goto fail; ++ ++ /* Not an error case, just reached the end of the attributes. */ ++ if (attr_size == 0) ++ return false; ++ ++ /* ++ * Extra validation by trying to calculate a minimum possible size for this ++ * attribute. +8 from the size of the resident data struct which is the ++ * minimum that can be added. ++ */ ++ min_size = GRUB_NTFS_ATTRIBUTE_HEADER_SIZE + 8; ++ ++ if (min_size > attr_size) ++ goto fail; ++ ++ /* Is the data is resident (0) or not (1). */ ++ if (attr[GRUB_NTFS_ATTRIBUTE_RESIDENT] == 0) ++ { ++ /* Read the offset and size of the attribute. */ ++ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_RES_OFFSET); ++ curr += u32at (attr, GRUB_NTFS_ATTRIBUTE_RES_LENGTH); ++ if (curr > min_size) ++ min_size = curr; ++ } ++ else ++ { ++ /* ++ * If the data is non-resident, the minimum size is 64 which is where ++ * the data runs start. We already have a minimum size of 24. So, just ++ * adding 40 to get to the real value. ++ */ ++ min_size += 40; ++ if (min_size > attr_size) ++ goto fail; ++ /* If the compression unit size is > 0, +8 bytes*/ ++ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE) > 0) ++ min_size += 8; ++ ++ /* ++ * Need to consider the data runs now. Each member of the run has byte ++ * that describes the size of the data length and offset. Each being ++ * 4 bits in the byte. ++ */ ++ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_DATA_RUNS); ++ ++ if (curr + 1 > min_size) ++ min_size = curr + 1; ++ ++ if (min_size > attr_size) ++ goto fail; ++ ++ /* ++ * Each attribute can store multiple data runs which are stored ++ * continuously in the attribute. They exist as one header byte ++ * with up to 14 bytes following it depending on the lengths. ++ * We stop when we hit a header that is just a NUL byte. ++ * ++ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/data_runs.html ++ */ ++ while (attr[curr] != 0) ++ { ++ /* ++ * We stop when we hit a header that is just a NUL byte. The data ++ * run header is stored as a single byte where the top 4 bits refer ++ * to the number of bytes used to store the total length of the ++ * data run, and the number of bytes used to store the offset. ++ * These directly follow the header byte, so we use them to update ++ * the minimum size. ++ */ ++ min_size += (attr[curr] & 0x7) + ((attr[curr] >> 4) & 0x7); ++ curr += min_size; ++ min_size++; ++ if (min_size > attr_size) ++ goto fail; ++ } ++ } ++ ++ /* Name offset, doing this after data residence checks. */ ++ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET) != 0) ++ { ++ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET); ++ /* ++ * Multiple the name length by 2 as its UTF-16. Can be zero if this in an ++ * unamed attribute. ++ */ ++ curr += attr[GRUB_NTFS_ATTRIBUTE_NAME_LENGTH] * 2; ++ if (curr > min_size) ++ min_size = curr; ++ } ++ ++ /* Padded to 8 bytes. */ ++ if (min_size % 8 != 0) ++ min_size += 8 - (min_size % 8); ++ ++ /* ++ * At this point min_size should be exactly attr_size but being flexible ++ * here to avoid any issues. ++ */ ++ if (min_size > attr_size) ++ goto fail; ++ ++ return true; ++ ++ fail: ++ grub_dprintf ("ntfs", "spare=%" PRIuGRUB_SIZE " min_size=%" PRIuGRUB_SIZE " attr_size=%" PRIuGRUB_SIZE "\n", ++ spare, min_size, attr_size); ++ return false; ++} ++ + /* Return the next attribute if it exists, otherwise return NULL. */ + static grub_uint8_t * + next_attribute (grub_uint8_t *curr_attribute, void *end) +@@ -84,6 +227,8 @@ next_attribute (grub_uint8_t *curr_attribute, void *end) + return NULL; + + next += u16at (curr_attribute, 4); ++ if (validate_attribute (next, end) == false) ++ return NULL; + + return next; + } +@@ -290,6 +435,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + /* From this point on pa_end is the end of the buffer */ + at->end = pa_end; + ++ if (validate_attribute (at->attr_nxt, pa_end) == false) ++ return NULL; ++ + while (at->attr_nxt) + { + if ((*at->attr_nxt == attr) || (attr == 0)) +@@ -319,6 +467,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) + + 1)); + pa = at->attr_nxt + u16at (pa, 4); + ++ if (validate_attribute (pa, pa_end) == true) ++ pa = NULL; ++ + while (pa) + { + if (*pa != attr) +@@ -572,6 +723,8 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, + else + vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); + pa = at->attr_nxt + u16at (at->attr_nxt, 4); ++ if (validate_attribute (pa, at->attr_end) == false) ++ pa = NULL; + + while (pa) + { +diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h +index 2c8078403..77b182acf 100644 +--- a/include/grub/ntfs.h ++++ b/include/grub/ntfs.h +@@ -91,6 +91,28 @@ enum + + #define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 + ++/* ++ * To make attribute validation clearer the offsets for each value in the ++ * attribute headers are defined as macros. ++ * ++ * These offsets are all from: ++ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html ++ */ ++ ++/* These offsets are part of the attribute header. */ ++#define GRUB_NTFS_ATTRIBUTE_LENGTH 4 ++#define GRUB_NTFS_ATTRIBUTE_RESIDENT 8 ++#define GRUB_NTFS_ATTRIBUTE_NAME_LENGTH 9 ++#define GRUB_NTFS_ATTRIBUTE_NAME_OFFSET 10 ++ ++/* Offsets for values needed for resident data. */ ++#define GRUB_NTFS_ATTRIBUTE_RES_LENGTH 16 ++#define GRUB_NTFS_ATTRIBUTE_RES_OFFSET 20 ++ ++/* Offsets for values needed for non-resident data. */ ++#define GRUB_NTFS_ATTRIBUTE_DATA_RUNS 32 ++#define GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE 34 ++ + enum + { + GRUB_NTFS_AF_ALST = 1, diff --git a/0302-fs-xfs-Fix-out-of-bounds-read.patch b/0302-fs-xfs-Fix-out-of-bounds-read.patch new file mode 100644 index 00000000..a71ff511 --- /dev/null +++ b/0302-fs-xfs-Fix-out-of-bounds-read.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Fri, 31 May 2024 15:14:57 +0800 +Subject: [PATCH] fs/xfs: Fix out-of-bounds read + +The number of records in the root key array read from disk was not being +validated against the size of the root node. This could lead to an +out-of-bounds read. + +This patch adds a check to ensure that the number of records in the root +key array does not exceed the expected size of a root node read from +disk. If this check detects an out-of-bounds condition the operation is +aborted to prevent random errors due to metadata corruption. + +Reported-by: Daniel Axtens +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 92046f9bd..96f62c5a4 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -595,6 +595,17 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + do + { + grub_uint64_t i; ++ grub_addr_t keys_end, data_end; ++ ++ if (grub_mul (sizeof (grub_uint64_t), nrec, &keys_end) || ++ grub_add ((grub_addr_t) keys, keys_end, &keys_end) || ++ grub_add ((grub_addr_t) node->data, node->data->data_size, &data_end) || ++ keys_end > data_end) ++ { ++ grub_error (GRUB_ERR_BAD_FS, "invalid number of XFS root keys"); ++ grub_free (leaf); ++ return 0; ++ } + + for (i = 0; i < nrec; i++) + { diff --git a/0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch b/0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch new file mode 100644 index 00000000..39f0adaa --- /dev/null +++ b/0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 06:03:58 +0100 +Subject: [PATCH] fs/xfs: Ensuring failing to mount sets a grub_errno + +It was previously possible for grub_xfs_mount() to return NULL without +setting grub_errno if the XFS version was invalid. This resulted in it +being possible for grub_dl_unref() to be called twice allowing the XFS +module to be unloaded while there were still references to it. + +Fixing this problem in general by ensuring a grub_errno is set if the +fail label is reached. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/xfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 96f62c5a4..a837f9824 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -327,6 +327,8 @@ static int grub_xfs_sb_valid(struct grub_xfs_data *data) + } + return 1; + } ++ ++ grub_error (GRUB_ERR_BAD_FS, "unsupported XFS filesystem version"); + return 0; + } + +@@ -1068,7 +1070,7 @@ grub_xfs_mount (grub_disk_t disk) + return data; + fail: + +- if (grub_errno == GRUB_ERR_OUT_OF_RANGE) ++ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE) + grub_error (GRUB_ERR_BAD_FS, "not an XFS filesystem"); + + grub_free (data); diff --git a/0304-kern-file-Ensure-file-data-is-set.patch b/0304-kern-file-Ensure-file-data-is-set.patch new file mode 100644 index 00000000..260d1b08 --- /dev/null +++ b/0304-kern-file-Ensure-file-data-is-set.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 03:01:40 +0100 +Subject: [PATCH] kern/file: Ensure file->data is set + +This is to avoid a generic issue were some filesystems would not set +data and also not set a grub_errno. This meant it was possible for many +filesystems to grub_dl_unref() themselves multiple times resulting in +it being possible to unload the filesystems while there were still +references to them, e.g., via a loopback. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/file.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 75510df7c..85e832bd8 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -124,6 +124,9 @@ grub_file_open (const char *name, enum grub_file_type type) + if ((file->fs->fs_open) (file, file_name) != GRUB_ERR_NONE) + goto fail; + ++ if (file->data == NULL) ++ goto fail; ++ + file->name = grub_strdup (name); + grub_errno = GRUB_ERR_NONE; + diff --git a/0305-kern-file-Implement-filesystem-reference-counting.patch b/0305-kern-file-Implement-filesystem-reference-counting.patch new file mode 100644 index 00000000..348bebed --- /dev/null +++ b/0305-kern-file-Implement-filesystem-reference-counting.patch @@ -0,0 +1,440 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 13:44:25 -0600 +Subject: [PATCH] kern/file: Implement filesystem reference counting + +The grub_file_open() and grub_file_close() should be the only places +that allow a reference to a filesystem to stay open. So, add grub_dl_t +to grub_fs_t and set this in the GRUB_MOD_INIT() for each filesystem to +avoid issues when filesystems forget to do it themselves or do not track +their own references, e.g. squash4. + +The fs_label(), fs_uuid(), fs_mtime() and fs_read() should all ref and +unref in the same function but it is essentially redundant in GRUB +single threaded model. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/fs/affs.c | 1 + + grub-core/fs/bfs.c | 1 + + grub-core/fs/btrfs.c | 1 + + grub-core/fs/cbfs.c | 1 + + grub-core/fs/cpio.c | 1 + + grub-core/fs/cpio_be.c | 1 + + grub-core/fs/ext2.c | 1 + + grub-core/fs/f2fs.c | 1 + + grub-core/fs/fat.c | 1 + + grub-core/fs/hfs.c | 1 + + grub-core/fs/hfsplus.c | 1 + + grub-core/fs/iso9660.c | 1 + + grub-core/fs/jfs.c | 1 + + grub-core/fs/minix.c | 1 + + grub-core/fs/newc.c | 1 + + grub-core/fs/nilfs2.c | 1 + + grub-core/fs/ntfs.c | 1 + + grub-core/fs/odc.c | 1 + + grub-core/fs/proc.c | 1 + + grub-core/fs/reiserfs.c | 1 + + grub-core/fs/romfs.c | 1 + + grub-core/fs/sfs.c | 1 + + grub-core/fs/squash4.c | 1 + + grub-core/fs/tar.c | 1 + + grub-core/fs/udf.c | 1 + + grub-core/fs/ufs.c | 1 + + grub-core/fs/xfs.c | 1 + + grub-core/fs/zfs/zfs.c | 1 + + grub-core/kern/file.c | 7 +++++++ + include/grub/fs.h | 4 ++++ + 30 files changed, 39 insertions(+) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index ed606b3f1..9b0afb954 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -703,6 +703,7 @@ static struct grub_fs grub_affs_fs = + + GRUB_MOD_INIT(affs) + { ++ grub_affs_fs.mod = mod; + grub_fs_register (&grub_affs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c +index 07cb3e3ac..f37b16895 100644 +--- a/grub-core/fs/bfs.c ++++ b/grub-core/fs/bfs.c +@@ -1106,6 +1106,7 @@ GRUB_MOD_INIT (bfs) + { + COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == + sizeof (struct grub_bfs_extent)); ++ grub_bfs_fs.mod = mod; + grub_fs_register (&grub_bfs_fs); + } + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index ad35e7575..6593f5175 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -3402,6 +3402,7 @@ subvol_get_env (struct grub_env_var *var __attribute__ ((unused)), + + GRUB_MOD_INIT (btrfs) + { ++ grub_btrfs_fs.mod = mod; + grub_fs_register (&grub_btrfs_fs); + cmd_info = grub_register_command("btrfs-info", grub_cmd_btrfs_info, + "DEVICE", +diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c +index 8ab7106af..2332745fe 100644 +--- a/grub-core/fs/cbfs.c ++++ b/grub-core/fs/cbfs.c +@@ -390,6 +390,7 @@ GRUB_MOD_INIT (cbfs) + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + init_cbfsdisk (); + #endif ++ grub_cbfs_fs.mod = mod; + grub_fs_register (&grub_cbfs_fs); + } + +diff --git a/grub-core/fs/cpio.c b/grub-core/fs/cpio.c +index dab5f9898..1799f7ff5 100644 +--- a/grub-core/fs/cpio.c ++++ b/grub-core/fs/cpio.c +@@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size) + + GRUB_MOD_INIT (cpio) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/cpio_be.c b/grub-core/fs/cpio_be.c +index 846548892..7bed1b848 100644 +--- a/grub-core/fs/cpio_be.c ++++ b/grub-core/fs/cpio_be.c +@@ -52,6 +52,7 @@ read_number (const grub_uint16_t *arr, grub_size_t size) + + GRUB_MOD_INIT (cpio_be) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index 3f9f6b208..c3058f7e7 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -1131,6 +1131,7 @@ static struct grub_fs grub_ext2_fs = + + GRUB_MOD_INIT(ext2) + { ++ grub_ext2_fs.mod = mod; + grub_fs_register (&grub_ext2_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index db8a65f8d..f6d6beaa5 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -1353,6 +1353,7 @@ static struct grub_fs grub_f2fs_fs = { + + GRUB_MOD_INIT (f2fs) + { ++ grub_f2fs_fs.mod = mod; + grub_fs_register (&grub_f2fs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/fat.c b/grub-core/fs/fat.c +index c5efed724..6e62b915d 100644 +--- a/grub-core/fs/fat.c ++++ b/grub-core/fs/fat.c +@@ -1312,6 +1312,7 @@ GRUB_MOD_INIT(fat) + #endif + { + COMPILE_TIME_ASSERT (sizeof (struct grub_fat_dir_entry) == 32); ++ grub_fat_fs.mod = mod; + grub_fs_register (&grub_fat_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c +index 920112b03..ce7581dd5 100644 +--- a/grub-core/fs/hfs.c ++++ b/grub-core/fs/hfs.c +@@ -1434,6 +1434,7 @@ static struct grub_fs grub_hfs_fs = + + GRUB_MOD_INIT(hfs) + { ++ grub_hfs_fs.mod = mod; + if (!grub_is_lockdown ()) + grub_fs_register (&grub_hfs_fs); + my_mod = mod; +diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c +index de71fd486..3f203abcc 100644 +--- a/grub-core/fs/hfsplus.c ++++ b/grub-core/fs/hfsplus.c +@@ -1176,6 +1176,7 @@ static struct grub_fs grub_hfsplus_fs = + + GRUB_MOD_INIT(hfsplus) + { ++ grub_hfsplus_fs.mod = mod; + grub_fs_register (&grub_hfsplus_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/iso9660.c b/grub-core/fs/iso9660.c +index 8e3c95c4f..c73cb9ce0 100644 +--- a/grub-core/fs/iso9660.c ++++ b/grub-core/fs/iso9660.c +@@ -1260,6 +1260,7 @@ static struct grub_fs grub_iso9660_fs = + + GRUB_MOD_INIT(iso9660) + { ++ grub_iso9660_fs.mod = mod; + grub_fs_register (&grub_iso9660_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index 70a2f4947..b0283ac00 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -1005,6 +1005,7 @@ static struct grub_fs grub_jfs_fs = + + GRUB_MOD_INIT(jfs) + { ++ grub_jfs_fs.mod = mod; + grub_fs_register (&grub_jfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c +index 5354951d1..b7679c3e2 100644 +--- a/grub-core/fs/minix.c ++++ b/grub-core/fs/minix.c +@@ -734,6 +734,7 @@ GRUB_MOD_INIT(minix) + #endif + #endif + { ++ grub_minix_fs.mod = mod; + grub_fs_register (&grub_minix_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/newc.c b/grub-core/fs/newc.c +index 4fb8b2e3d..43b7f8b64 100644 +--- a/grub-core/fs/newc.c ++++ b/grub-core/fs/newc.c +@@ -64,6 +64,7 @@ read_number (const char *str, grub_size_t size) + + GRUB_MOD_INIT (newc) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index fc7374ead..4e1e71738 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -1231,6 +1231,7 @@ GRUB_MOD_INIT (nilfs2) + grub_nilfs2_dat_entry)); + COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE + == sizeof (struct grub_nilfs2_inode)); ++ grub_nilfs2_fs.mod = mod; + grub_fs_register (&grub_nilfs2_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 64f4f2221..4e144cc3c 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -1541,6 +1541,7 @@ static struct grub_fs grub_ntfs_fs = + + GRUB_MOD_INIT (ntfs) + { ++ grub_ntfs_fs.mod = mod; + grub_fs_register (&grub_ntfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/odc.c b/grub-core/fs/odc.c +index 790000622..8e4e8aeac 100644 +--- a/grub-core/fs/odc.c ++++ b/grub-core/fs/odc.c +@@ -52,6 +52,7 @@ read_number (const char *str, grub_size_t size) + + GRUB_MOD_INIT (odc) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/proc.c b/grub-core/fs/proc.c +index 5f516502d..bcde43349 100644 +--- a/grub-core/fs/proc.c ++++ b/grub-core/fs/proc.c +@@ -192,6 +192,7 @@ static struct grub_fs grub_procfs_fs = + + GRUB_MOD_INIT (procfs) + { ++ grub_procfs_fs.mod = mod; + grub_disk_dev_register (&grub_procfs_dev); + grub_fs_register (&grub_procfs_fs); + } +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index 42818c376..e8b0b6383 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -1407,6 +1407,7 @@ static struct grub_fs grub_reiserfs_fs = + + GRUB_MOD_INIT(reiserfs) + { ++ grub_reiserfs_fs.mod = mod; + grub_fs_register (&grub_reiserfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c +index 1f7dcfca1..56b0b2b2f 100644 +--- a/grub-core/fs/romfs.c ++++ b/grub-core/fs/romfs.c +@@ -475,6 +475,7 @@ static struct grub_fs grub_romfs_fs = + + GRUB_MOD_INIT(romfs) + { ++ grub_romfs_fs.mod = mod; + grub_fs_register (&grub_romfs_fs); + } + +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index 983e88008..f0d7cac43 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -779,6 +779,7 @@ static struct grub_fs grub_sfs_fs = + + GRUB_MOD_INIT(sfs) + { ++ grub_sfs_fs.mod = mod; + grub_fs_register (&grub_sfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index a30e6ebe1..6e9d63874 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -1044,6 +1044,7 @@ static struct grub_fs grub_squash_fs = + + GRUB_MOD_INIT(squash4) + { ++ grub_squash_fs.mod = mod; + grub_fs_register (&grub_squash_fs); + } + +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index 386c09022..fd2ec1f74 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -354,6 +354,7 @@ static struct grub_fs grub_cpio_fs = { + + GRUB_MOD_INIT (tar) + { ++ grub_cpio_fs.mod = mod; + grub_fs_register (&grub_cpio_fs); + } + +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index b836e6107..8765c633c 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -1455,6 +1455,7 @@ static struct grub_fs grub_udf_fs = { + + GRUB_MOD_INIT (udf) + { ++ grub_udf_fs.mod = mod; + grub_fs_register (&grub_udf_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index 01235101b..e82d9356d 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -899,6 +899,7 @@ GRUB_MOD_INIT(ufs1) + #endif + #endif + { ++ grub_ufs_fs.mod = mod; + grub_fs_register (&grub_ufs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index a837f9824..6c952aef1 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -1304,6 +1304,7 @@ static struct grub_fs grub_xfs_fs = + + GRUB_MOD_INIT(xfs) + { ++ grub_xfs_fs.mod = mod; + grub_fs_register (&grub_xfs_fs); + my_mod = mod; + } +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index b5453e006..a497b1869 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -4424,6 +4424,7 @@ static struct grub_fs grub_zfs_fs = { + GRUB_MOD_INIT (zfs) + { + COMPILE_TIME_ASSERT (sizeof (zap_leaf_chunk_t) == ZAP_LEAF_CHUNKSIZE); ++ grub_zfs_fs.mod = mod; + grub_fs_register (&grub_zfs_fs); + #ifndef GRUB_UTIL + my_mod = mod; +diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c +index 85e832bd8..ec90a26ba 100644 +--- a/grub-core/kern/file.c ++++ b/grub-core/kern/file.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + void (*EXPORT_VAR (grub_grubnet_fini)) (void); + +@@ -127,6 +128,9 @@ grub_file_open (const char *name, enum grub_file_type type) + if (file->data == NULL) + goto fail; + ++ if (file->fs->mod) ++ grub_dl_ref (file->fs->mod); ++ + file->name = grub_strdup (name); + grub_errno = GRUB_ERR_NONE; + +@@ -219,6 +223,9 @@ grub_file_read (grub_file_t file, void *buf, grub_size_t len) + grub_err_t + grub_file_close (grub_file_t file) + { ++ if (file->fs->mod) ++ grub_dl_unref (file->fs->mod); ++ + grub_dprintf ("file", "Closing `%s' ...\n", file->name); + if (file->fs->fs_close) + (file->fs->fs_close) (file); +diff --git a/include/grub/fs.h b/include/grub/fs.h +index 026bc3bb8..df4c93b16 100644 +--- a/include/grub/fs.h ++++ b/include/grub/fs.h +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + /* For embedding types. */ +@@ -57,6 +58,9 @@ struct grub_fs + /* My name. */ + const char *name; + ++ /* My module */ ++ grub_dl_t mod; ++ + /* Call HOOK with each file under DIR. */ + grub_err_t (*fs_dir) (grub_device_t device, const char *path, + grub_fs_dir_hook_t hook, void *hook_data); diff --git a/0306-cli_lock-Add-build-option-to-block-command-line-inte.patch b/0306-cli_lock-Add-build-option-to-block-command-line-inte.patch new file mode 100644 index 00000000..3c7d6414 --- /dev/null +++ b/0306-cli_lock-Add-build-option-to-block-command-line-inte.patch @@ -0,0 +1,366 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 24 Jan 2024 06:26:37 +0000 +Subject: [PATCH] cli_lock: Add build option to block command line interface + +Add functionality to disable command line interface access and editing of GRUB +menu entries if GRUB image is built with --disable-cli. + +Signed-off-by: Alec Brown +Reviewed-by: Vladimir Serbinenko +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 6 ++++-- + grub-core/kern/main.c | 28 ++++++++++++++++++++++++++++ + grub-core/kern/rescue_reader.c | 13 +++++++++++++ + grub-core/normal/auth.c | 3 +++ + grub-core/normal/menu_text.c | 31 +++++++++++++++++-------------- + include/grub/kernel.h | 1 + + include/grub/misc.h | 2 ++ + include/grub/util/install.h | 8 ++++++-- + util/grub-install-common.c | 10 ++++++++-- + util/grub-mkimage.c | 9 ++++++++- + util/mkimage.c | 15 ++++++++++++++- + 11 files changed, 104 insertions(+), 22 deletions(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 096a3cde0..9ce9c5b82 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -6520,8 +6520,10 @@ the GRUB command line, edit menu entries, and execute any menu entry. If + @samp{superusers} is set, then use of the command line and editing of menu + entries are automatically restricted to superusers. Setting @samp{superusers} + to empty string effectively disables both access to CLI and editing of menu +-entries. Note: The environment variable needs to be exported to also affect +-the section defined by the @samp{submenu} command (@pxref{submenu}). ++entries. Building a grub image with @samp{--disable-cli} option will also ++disable access to CLI and editing of menu entries, as well as disabling rescue ++mode. Note: The environment variable needs to be exported to also affect the ++section defined by the @samp{submenu} command (@pxref{submenu}). + + Other users may be allowed to execute specific menu entries by giving a list of + usernames (as above) using the @option{--users} option to the +diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c +index 8e89763f4..0d6b8138d 100644 +--- a/grub-core/kern/main.c ++++ b/grub-core/kern/main.c +@@ -30,11 +30,14 @@ + #include + #include + #include ++#include + + #ifdef GRUB_MACHINE_PCBIOS + #include + #endif + ++static bool cli_disabled = false; ++ + grub_addr_t + grub_modules_get_end (void) + { +@@ -299,6 +302,28 @@ grub_load_normal_mode (void) + grub_command_execute ("normal", 0, 0); + } + ++bool ++grub_is_cli_disabled (void) ++{ ++ return cli_disabled; ++} ++ ++static void ++check_is_cli_disabled (void) ++{ ++ struct grub_module_header *header; ++ header = 0; ++ ++ FOR_MODULES (header) ++ { ++ if (header->type == OBJ_TYPE_DISABLE_CLI) ++ { ++ cli_disabled = true; ++ return; ++ } ++ } ++} ++ + static void + reclaim_module_space (void) + { +@@ -356,6 +381,9 @@ grub_main (void) + + grub_boot_time ("After loading embedded modules."); + ++ /* Check if the CLI should be disabled */ ++ check_is_cli_disabled (); ++ + /* It is better to set the root device as soon as possible, + for convenience. */ + grub_set_prefix_and_root (); +diff --git a/grub-core/kern/rescue_reader.c b/grub-core/kern/rescue_reader.c +index dcd7d4439..4259857ba 100644 +--- a/grub-core/kern/rescue_reader.c ++++ b/grub-core/kern/rescue_reader.c +@@ -78,6 +78,19 @@ grub_rescue_read_line (char **line, int cont, + void __attribute__ ((noreturn)) + grub_rescue_run (void) + { ++ /* Stall if the CLI has been disabled */ ++ if (grub_is_cli_disabled ()) ++ { ++ grub_printf ("Rescue mode has been disabled...\n"); ++ ++ do ++ { ++ /* Do not optimize out the loop. */ ++ asm volatile (""); ++ } ++ while (1); ++ } ++ + grub_printf ("Entering rescue mode...\n"); + + while (1) +diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c +index 517fc623f..d94020186 100644 +--- a/grub-core/normal/auth.c ++++ b/grub-core/normal/auth.c +@@ -209,6 +209,9 @@ grub_auth_check_authentication (const char *userlist) + char entered[GRUB_AUTH_MAX_PASSLEN]; + struct grub_auth_user *user; + ++ if (grub_is_cli_disabled ()) ++ return GRUB_ACCESS_DENIED; ++ + grub_memset (login, 0, sizeof (login)); + + if (is_authenticated (userlist)) +diff --git a/grub-core/normal/menu_text.c b/grub-core/normal/menu_text.c +index b1321eb26..9c383e64a 100644 +--- a/grub-core/normal/menu_text.c ++++ b/grub-core/normal/menu_text.c +@@ -178,21 +178,24 @@ command-line or ESC to discard edits and return to the GRUB menu."), + + grub_free (msg_translated); + +- if (nested) ++ if (!grub_is_cli_disabled ()) + { +- ret += grub_print_message_indented_real +- (_("Press enter to boot the selected OS, " +- "`e' to edit the commands before booting " +- "or `c' for a command-line. ESC to return previous menu."), +- STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); +- } +- else +- { +- ret += grub_print_message_indented_real +- (_("Press enter to boot the selected OS, " +- "`e' to edit the commands before booting " +- "or `c' for a command-line."), +- STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ if (nested) ++ { ++ ret += grub_print_message_indented_real ++ (_("Press enter to boot the selected OS, " ++ "`e' to edit the commands before booting " ++ "or `c' for a command-line. ESC to return previous menu."), ++ STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ } ++ else ++ { ++ ret += grub_print_message_indented_real ++ (_("Press enter to boot the selected OS, " ++ "`e' to edit the commands before booting " ++ "or `c' for a command-line."), ++ STANDARD_MARGIN, STANDARD_MARGIN, term, dry_run); ++ } + } + } + return ret; +diff --git a/include/grub/kernel.h b/include/grub/kernel.h +index 98edc0863..f98a780da 100644 +--- a/include/grub/kernel.h ++++ b/include/grub/kernel.h +@@ -33,6 +33,7 @@ enum + OBJ_TYPE_DISABLE_SHIM_LOCK, + OBJ_TYPE_GPG_PUBKEY, + OBJ_TYPE_X509_PUBKEY, ++ OBJ_TYPE_DISABLE_CLI + }; + + /* The module header. */ +diff --git a/include/grub/misc.h b/include/grub/misc.h +index 6b1e084af..d6e9bae8e 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -442,6 +442,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, + grub_uint64_t d, + grub_uint64_t *r); + ++extern bool EXPORT_FUNC(grub_is_cli_disabled) (void); ++ + /* Must match softdiv group in gentpl.py. */ + #if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \ + (defined(__riscv) && (__riscv_xlen == 32))) +diff --git a/include/grub/util/install.h b/include/grub/util/install.h +index 59eabb9bb..dbf3c216d 100644 +--- a/include/grub/util/install.h ++++ b/include/grub/util/install.h +@@ -72,6 +72,8 @@ + { "appended-signature-size", GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,\ + "SIZE", 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), \ + 1}, \ ++ { "disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, \ ++ N_("disabled command line interface access"), 0 }, \ + { "verbose", 'v', 0, 0, \ + N_("print verbose messages."), 1 } + +@@ -135,7 +137,8 @@ enum grub_install_options { + GRUB_INSTALL_OPTIONS_DTB, + GRUB_INSTALL_OPTIONS_SBAT, + GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, +- GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE ++ GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE, ++ GRUB_INSTALL_OPTIONS_DISABLE_CLI + }; + + extern char *grub_install_source_directory; +@@ -198,7 +201,8 @@ grub_install_generate_image (const char *dir, const char *prefix, + const struct grub_install_image_target_desc *image_target, + int note, size_t appsig_size, + grub_compression_t comp, const char *dtb_file, +- const char *sbat_path, const int disable_shim_lock); ++ const char *sbat_path, const int disable_shim_lock, ++ const int disable_cli); + + const struct grub_install_image_target_desc * + grub_install_get_image_target (const char *arg); +diff --git a/util/grub-install-common.c b/util/grub-install-common.c +index 67afc2eed..42aec141e 100644 +--- a/util/grub-install-common.c ++++ b/util/grub-install-common.c +@@ -469,6 +469,7 @@ static char **x509keys; + static size_t nx509keys; + static grub_compression_t compression; + static size_t appsig_size; ++static int disable_cli; + + int + grub_install_parse (int key, char *arg) +@@ -514,6 +515,9 @@ grub_install_parse (int key, char *arg) + * (nx509keys + 1)); + x509keys[nx509keys++] = xstrdup (arg); + return 1; ++ case GRUB_INSTALL_OPTIONS_DISABLE_CLI: ++ disable_cli = 1; ++ return 1; + + case GRUB_INSTALL_OPTIONS_VERBOSITY: + verbosity++; +@@ -708,11 +712,13 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, + grub_util_info ("grub-mkimage --directory '%s' --prefix '%s' --output '%s'" + " --format '%s' --compression '%s'" + " --appended-signture-size %zu %s%s%s\n", ++ " --format '%s' --compression '%s'%s%s%s%s\n", + dir, prefix, outname, + mkimage_target, compnames[compression], + appsig_size, + note ? " --note" : "", +- disable_shim_lock ? " --disable-shim-lock" : "", s); ++ disable_shim_lock ? " --disable-shim-lock" : "", ++ disable_cli ? " --disable-cli" : "", s); + free (s); + + tgt = grub_install_get_image_target (mkimage_target); +@@ -725,7 +731,7 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix, + x509keys, nx509keys, + config_path, tgt, + note, appsig_size, compression, dtb, sbat, +- disable_shim_lock); ++ disable_shim_lock, disable_cli); + while (dc--) + grub_install_pop_module (); + } +diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c +index e1f111278..13bdc6cf0 100644 +--- a/util/grub-mkimage.c ++++ b/util/grub-mkimage.c +@@ -84,6 +84,7 @@ static struct argp_option options[] = { + {"compression", 'C', "(xz|none|auto)", 0, N_("choose the compression to use for core image"), 0}, + {"sbat", 's', N_("FILE"), 0, N_("SBAT metadata"), 0}, + {"disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, N_("disable shim_lock verifier"), 0}, ++ {"disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, N_("disable command line interface access"), 0}, + {"verbose", 'v', 0, 0, N_("print verbose messages."), 0}, + {"appended-signature-size", 'S', N_("SIZE"), 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), 0}, + { 0, 0, 0, 0, 0, 0 } +@@ -133,6 +134,7 @@ struct arguments + int note; + int disable_shim_lock; + size_t appsig_size; ++ int disable_cli; + const struct grub_install_image_target_desc *image_target; + grub_compression_t comp; + }; +@@ -259,6 +261,10 @@ argp_parser (int key, char *arg, struct argp_state *state) + arguments->disable_shim_lock = 1; + break; + ++ case GRUB_INSTALL_OPTIONS_DISABLE_CLI: ++ arguments->disable_cli = 1; ++ break; ++ + case 'v': + verbosity++; + break; +@@ -347,7 +353,8 @@ main (int argc, char *argv[]) + arguments.image_target, arguments.note, + arguments.appsig_size, arguments.comp, + arguments.dtb, arguments.sbat, +- arguments.disable_shim_lock); ++ arguments.disable_shim_lock, ++ arguments.disable_cli); + + if (grub_util_file_sync (fp) < 0) + grub_util_error (_("cannot sync `%s': %s"), arguments.output ? : "stdout", +diff --git a/util/mkimage.c b/util/mkimage.c +index 425d920ff..f31fdefa8 100644 +--- a/util/mkimage.c ++++ b/util/mkimage.c +@@ -888,7 +888,7 @@ grub_install_generate_image (const char *dir, const char *prefix, + const struct grub_install_image_target_desc *image_target, + int note, size_t appsig_size, grub_compression_t comp, + const char *dtb_path, const char *sbat_path, +- int disable_shim_lock) ++ int disable_shim_lock, int disable_cli) + { + char *kernel_img, *core_img; + size_t total_module_size, core_size; +@@ -963,6 +963,9 @@ grub_install_generate_image (const char *dir, const char *prefix, + if (disable_shim_lock) + total_module_size += sizeof (struct grub_module_header); + ++ if (disable_cli) ++ total_module_size += sizeof (struct grub_module_header); ++ + if (config_path) + { + config_size = ALIGN_ADDR (grub_util_get_image_size (config_path) + 1); +@@ -1129,6 +1132,16 @@ grub_install_generate_image (const char *dir, const char *prefix, + offset += sizeof (*header); + } + ++ if (disable_cli) ++ { ++ struct grub_module_header *header; ++ ++ header = (struct grub_module_header *) (kernel_img + offset); ++ header->type = grub_host_to_target32 (OBJ_TYPE_DISABLE_CLI); ++ header->size = grub_host_to_target32 (sizeof (*header)); ++ offset += sizeof (*header); ++ } ++ + if (config_path) + { + struct grub_module_header *header; diff --git a/0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch b/0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch new file mode 100644 index 00000000..2c2396ad --- /dev/null +++ b/0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch @@ -0,0 +1,337 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang +Date: Tue, 11 Feb 2025 15:08:06 -0600 +Subject: [PATCH] disk/cryptodisk: Require authentication after TPM unlock for + CLI access + +The GRUB may use TPM to verify the integrity of boot components and the +result can determine whether a previously sealed key can be released. If +everything checks out, showing nothing has been tampered with, the key +is released and GRUB unlocks the encrypted root partition for the next +stage of booting. + +However, the liberal Command Line Interface (CLI) can be misused by +anyone in this case to access files in the encrypted partition one way +or another. Despite efforts to keep the CLI secure by preventing utility +command output from leaking file content, many techniques in the wild +could still be used to exploit the CLI, enabling attacks or learning +methods to attack. It's nearly impossible to account for all scenarios +where a hack could be applied. + +Therefore, to mitigate potential misuse of the CLI after the root device +has been successfully unlocked via TPM, the user should be required to +authenticate using the LUKS password. This added layer of security +ensures that only authorized users can access the CLI reducing the risk +of exploitation or unauthorized access to the encrypted partition. + +Fixes: CVE-2024-49504 + +Signed-off-by: Michael Chang +Reviewed-by: Daniel Kiper +--- + docs/grub.texi | 29 +++++++++++++++ + grub-core/disk/cryptodisk.c | 87 ++++++++++++++++++++++++++++++++++++++++++- + grub-core/kern/main.c | 12 ++++++ + grub-core/normal/auth.c | 30 +++++++++++++++ + grub-core/normal/main.c | 4 ++ + grub-core/normal/menu_entry.c | 4 ++ + include/grub/auth.h | 1 + + include/grub/cryptodisk.h | 3 ++ + include/grub/misc.h | 2 + + 9 files changed, 171 insertions(+), 1 deletion(-) + +diff --git a/docs/grub.texi b/docs/grub.texi +index 9ce9c5b82..2d6d73a78 100644 +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -6882,6 +6882,35 @@ sign-file SHA256 grub.key certificate.der core.elf.unsigned core.elf.signed + As with UEFI secure boot, it is necessary to build in the required modules, + or sign them separately. + ++@subsection Command line and menuentry editor protection ++ ++The TPM key protector provides full disk encryption support on servers or ++virtual machine images, meanwhile keeping the boot process unattended. This ++prevents service disruptions by eliminating the need for manual password input ++during startup, improving system uptime and continuity. It is achieved by TPM, ++which verifies the integrity of boot components by checking cryptographic ++hashes against securely stored values, to confirm the disks are unlocked in a ++trusted state. ++ ++However, for users to access the system interactively, some form of ++authentication is still required, as the disks are not unlocked by an ++authorized user. This raised concerns about using an unprotected ++@samp{command-line interface} (@pxref{Command-line interface}), as anyone could ++execute commands to access decrypted data. To address this issue, the LUKS ++password is used to ensure that only authorized users are granted access to the ++interface. Additionally, the @samp{menu entry editor} (@pxref{Menu entry ++editor}) is also safeguarded by the LUKS password, as modifying a boot entry is ++effectively the same as altering the @file{grub.cfg} file read from encrypted ++files. ++ ++It is worth mentioning that the built-in password support, as described in ++@samp{Authentication and Authorization in GRUB} (@pxref{Authentication and ++authorisation}), can also be used to protect the command-line interface from ++unauthorized access. However, it is not recommended to rely on this approach as ++it is an optional step. Setting it up requires additional manual intervention, ++which increases the risk of password leakage during the process. Moreover, the ++superuser list must be well maintained, and the password used cannot be ++synchronized with LUKS key rotation. + + @node Platform limitations + @chapter Platform limitations +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 98e176a13..06a42b2d7 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -1144,7 +1144,9 @@ grub_cryptodisk_scan_device_real (const char *name, + ret = grub_cryptodisk_insert (dev, name, source); + if (ret != GRUB_ERR_NONE) + goto error; +- ++#ifndef GRUB_UTIL ++ grub_cli_set_auth_needed (); ++#endif + goto cleanup; + } + grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk module can handle this device"); +@@ -1576,6 +1578,89 @@ luks_script_get (grub_size_t *sz) + return ret; + } + ++#ifdef GRUB_MACHINE_EFI ++grub_err_t ++grub_cryptodisk_challenge_password (void) ++{ ++ grub_cryptodisk_t cr_dev; ++ ++ for (cr_dev = cryptodisk_list; cr_dev != NULL; cr_dev = cr_dev->next) ++ { ++ grub_cryptodisk_dev_t cr; ++ grub_disk_t source = NULL; ++ grub_err_t ret = GRUB_ERR_NONE; ++ grub_cryptodisk_t dev = NULL; ++ char *part = NULL; ++ struct grub_cryptomount_args cargs = {0}; ++ ++ cargs.check_boot = 0; ++ cargs.search_uuid = cr_dev->uuid; ++ ++ source = grub_disk_open (cr_dev->source); ++ ++ if (source == NULL) ++ { ++ ret = grub_errno; ++ goto error_out; ++ } ++ ++ FOR_CRYPTODISK_DEVS (cr) ++ { ++ dev = cr->scan (source, &cargs); ++ if (grub_errno) ++ { ++ ret = grub_errno; ++ goto error_out; ++ } ++ if (dev == NULL) ++ continue; ++ break; ++ } ++ ++ if (dev == NULL) ++ { ++ ret = grub_error (GRUB_ERR_BAD_MODULE, "no cryptodisk module can handle this device"); ++ goto error_out; ++ } ++ ++ part = grub_partition_get_name (source->partition); ++ grub_printf_ (N_("Enter passphrase for %s%s%s (%s): "), source->name, ++ source->partition != NULL ? "," : "", ++ part != NULL ? part : N_("UNKNOWN"), cr_dev->uuid); ++ grub_free (part); ++ ++ cargs.key_data = grub_malloc (GRUB_CRYPTODISK_MAX_PASSPHRASE); ++ if (cargs.key_data == NULL) ++ { ++ ret = grub_errno; ++ goto error_out; ++ } ++ ++ if (!grub_password_get ((char *) cargs.key_data, GRUB_CRYPTODISK_MAX_PASSPHRASE)) ++ { ++ ret = grub_error (GRUB_ERR_BAD_ARGUMENT, "passphrase not supplied"); ++ goto error_out; ++ } ++ cargs.key_len = grub_strlen ((char *) cargs.key_data); ++ ret = cr->recover_key (source, dev, &cargs); ++ ++ error_out: ++ grub_disk_close (source); ++ if (dev != NULL) ++ cryptodisk_close (dev); ++ if (cargs.key_data) ++ { ++ grub_memset (cargs.key_data, 0, cargs.key_len); ++ grub_free (cargs.key_data); ++ } ++ ++ return ret; ++ } ++ ++ return GRUB_ERR_NONE; ++} ++#endif /* GRUB_MACHINE_EFI */ ++ + struct grub_procfs_entry luks_script = + { + .name = "luks_script", +diff --git a/grub-core/kern/main.c b/grub-core/kern/main.c +index 0d6b8138d..2e6b79ee3 100644 +--- a/grub-core/kern/main.c ++++ b/grub-core/kern/main.c +@@ -37,6 +37,7 @@ + #endif + + static bool cli_disabled = false; ++static bool cli_need_auth = false; + + grub_addr_t + grub_modules_get_end (void) +@@ -308,6 +309,17 @@ grub_is_cli_disabled (void) + return cli_disabled; + } + ++bool ++grub_is_cli_need_auth (void) ++{ ++ return cli_need_auth; ++} ++ ++void grub_cli_set_auth_needed (void) ++{ ++ cli_need_auth = true; ++} ++ + static void + check_is_cli_disabled (void) + { +diff --git a/grub-core/normal/auth.c b/grub-core/normal/auth.c +index d94020186..71b361bc0 100644 +--- a/grub-core/normal/auth.c ++++ b/grub-core/normal/auth.c +@@ -25,6 +25,10 @@ + #include + #include + ++#ifdef GRUB_MACHINE_EFI ++#include ++#endif ++ + struct grub_auth_user + { + struct grub_auth_user *next; +@@ -200,6 +204,32 @@ grub_username_get (char buf[], unsigned buf_size) + return (key != GRUB_TERM_ESC); + } + ++grub_err_t ++grub_auth_check_cli_access (void) ++{ ++ if (grub_is_cli_need_auth () == true) ++ { ++#ifdef GRUB_MACHINE_EFI ++ static bool authenticated = false; ++ ++ if (authenticated == false) ++ { ++ grub_err_t ret; ++ ++ ret = grub_cryptodisk_challenge_password (); ++ if (ret == GRUB_ERR_NONE) ++ authenticated = true; ++ return ret; ++ } ++ return GRUB_ERR_NONE; ++#else ++ return GRUB_ACCESS_DENIED; ++#endif ++ } ++ ++ return GRUB_ERR_NONE; ++} ++ + grub_err_t + grub_auth_check_authentication (const char *userlist) + { +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 26872ce94..86ffb388d 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -557,9 +557,13 @@ grub_cmdline_run (int nested, int force_auth) + } + while (err && force_auth); + ++ if (err == GRUB_ERR_NONE) ++ err = grub_auth_check_cli_access (); ++ + if (err) + { + grub_print_error (); ++ grub_wait_after_message (); + grub_errno = GRUB_ERR_NONE; + return; + } +diff --git a/grub-core/normal/menu_entry.c b/grub-core/normal/menu_entry.c +index ade56be2b..8b0d17e3f 100644 +--- a/grub-core/normal/menu_entry.c ++++ b/grub-core/normal/menu_entry.c +@@ -1255,9 +1255,13 @@ grub_menu_entry_run (grub_menu_entry_t entry) + + err = grub_auth_check_authentication (NULL); + ++ if (err == GRUB_ERR_NONE) ++ err = grub_auth_check_cli_access (); ++ + if (err) + { + grub_print_error (); ++ grub_wait_after_message (); + grub_errno = GRUB_ERR_NONE; + return; + } +diff --git a/include/grub/auth.h b/include/grub/auth.h +index 747334451..21d5190f0 100644 +--- a/include/grub/auth.h ++++ b/include/grub/auth.h +@@ -33,5 +33,6 @@ grub_err_t grub_auth_unregister_authentication (const char *user); + grub_err_t grub_auth_authenticate (const char *user); + grub_err_t grub_auth_deauthenticate (const char *user); + grub_err_t grub_auth_check_authentication (const char *userlist); ++grub_err_t grub_auth_check_cli_access (void); + + #endif /* ! GRUB_AUTH_HEADER */ +diff --git a/include/grub/cryptodisk.h b/include/grub/cryptodisk.h +index d94df68b6..d2572f8b0 100644 +--- a/include/grub/cryptodisk.h ++++ b/include/grub/cryptodisk.h +@@ -187,4 +187,7 @@ grub_util_get_geli_uuid (const char *dev); + grub_cryptodisk_t grub_cryptodisk_get_by_uuid (const char *uuid); + grub_cryptodisk_t grub_cryptodisk_get_by_source_disk (grub_disk_t disk); + ++#ifdef GRUB_MACHINE_EFI ++grub_err_t grub_cryptodisk_challenge_password (void); ++#endif + #endif +diff --git a/include/grub/misc.h b/include/grub/misc.h +index d6e9bae8e..0429339ef 100644 +--- a/include/grub/misc.h ++++ b/include/grub/misc.h +@@ -443,6 +443,8 @@ grub_uint64_t EXPORT_FUNC(grub_divmod64) (grub_uint64_t n, + grub_uint64_t *r); + + extern bool EXPORT_FUNC(grub_is_cli_disabled) (void); ++extern bool EXPORT_FUNC(grub_is_cli_need_auth) (void); ++extern void EXPORT_FUNC(grub_cli_set_auth_needed) (void); + + /* Must match softdiv group in gentpl.py. */ + #if !defined(GRUB_MACHINE_EMU) && (defined(__arm__) || defined(__ia64__) || \ diff --git a/0308-disk-loopback-Reference-tracking-for-the-loopback.patch b/0308-disk-loopback-Reference-tracking-for-the-loopback.patch new file mode 100644 index 00000000..5f6cd3af --- /dev/null +++ b/0308-disk-loopback-Reference-tracking-for-the-loopback.patch @@ -0,0 +1,108 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 15:22:28 -0600 +Subject: [PATCH] disk/loopback: Reference tracking for the loopback + +It was possible to delete a loopback while there were still references +to it. This led to an exploitable use-after-free. + +Fixed by implementing a reference counting in the grub_loopback struct. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/disk/loopback.c | 17 +++++++++++++++++ + include/grub/err.h | 3 ++- + include/grub/loopback.h | 1 + + 3 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/grub-core/disk/loopback.c b/grub-core/disk/loopback.c +index 11a5e0cbd..f39281323 100644 +--- a/grub-core/disk/loopback.c ++++ b/grub-core/disk/loopback.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -57,6 +58,8 @@ delete_loopback (const char *name) + if (! dev) + return grub_error (GRUB_ERR_BAD_DEVICE, "device not found"); + ++ if (dev->refcnt > 0) ++ return grub_error (GRUB_ERR_STILL_REFERENCED, "device still referenced"); + /* Remove the device from the list. */ + *prev = dev->next; + +@@ -113,6 +116,7 @@ grub_cmd_loopback (grub_extcmd_context_t ctxt, int argc, char **args) + + newdev->file = file; + newdev->id = last_id++; ++ newdev->refcnt = 0; + + /* Add the new entry to the list. */ + newdev->next = loopback_list; +@@ -154,6 +158,9 @@ grub_loopback_open (const char *name, grub_disk_t disk) + if (! dev) + return grub_error (GRUB_ERR_UNKNOWN_DEVICE, "can't open device"); + ++ if (grub_add (dev->refcnt, 1, &dev->refcnt)) ++ grub_fatal ("Reference count overflow"); ++ + /* Use the filesize for the disk size, round up to a complete sector. */ + if (dev->file->size != GRUB_FILE_SIZE_UNKNOWN) + disk->total_sectors = ((dev->file->size + GRUB_DISK_SECTOR_SIZE - 1) +@@ -171,6 +178,15 @@ grub_loopback_open (const char *name, grub_disk_t disk) + return 0; + } + ++static void ++grub_loopback_close (grub_disk_t disk) ++{ ++ struct grub_loopback *dev = disk->data; ++ ++ if (grub_sub (dev->refcnt, 1, &dev->refcnt)) ++ grub_fatal ("Reference count underflow"); ++} ++ + static grub_err_t + grub_loopback_read (grub_disk_t disk, grub_disk_addr_t sector, + grub_size_t size, char *buf) +@@ -213,6 +229,7 @@ static struct grub_disk_dev grub_loopback_dev = + .id = GRUB_DISK_DEVICE_LOOPBACK_ID, + .disk_iterate = grub_loopback_iterate, + .disk_open = grub_loopback_open, ++ .disk_close = grub_loopback_close, + .disk_read = grub_loopback_read, + .disk_write = grub_loopback_write, + .next = 0 +diff --git a/include/grub/err.h b/include/grub/err.h +index 3c587b9b8..29f1a73c5 100644 +--- a/include/grub/err.h ++++ b/include/grub/err.h +@@ -73,7 +73,8 @@ typedef enum + GRUB_ERR_NET_NO_DOMAIN, + GRUB_ERR_EOF, + GRUB_ERR_BAD_SIGNATURE, +- GRUB_ERR_BAD_FIRMWARE ++ GRUB_ERR_BAD_FIRMWARE, ++ GRUB_ERR_STILL_REFERENCED + } + grub_err_t; + +diff --git a/include/grub/loopback.h b/include/grub/loopback.h +index 3b9a9e32e..915ef65fc 100644 +--- a/include/grub/loopback.h ++++ b/include/grub/loopback.h +@@ -25,6 +25,7 @@ struct grub_loopback + grub_file_t file; + struct grub_loopback *next; + unsigned long id; ++ grub_uint64_t refcnt; + }; + + #endif /* ! GRUB_LOOPBACK_HEADER */ diff --git a/0309-kern-disk-Limit-recursion-depth.patch b/0309-kern-disk-Limit-recursion-depth.patch new file mode 100644 index 00000000..eba37f97 --- /dev/null +++ b/0309-kern-disk-Limit-recursion-depth.patch @@ -0,0 +1,120 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 04:09:24 +0100 +Subject: [PATCH] kern/disk: Limit recursion depth + +The grub_disk_read() may trigger other disk reads, e.g. via loopbacks. +This may lead to very deep recursion which can corrupt the heap. So, fix +the issue by limiting reads depth. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/disk.c | 27 ++++++++++++++++++++------- + include/grub/err.h | 3 ++- + 2 files changed, 22 insertions(+), 8 deletions(-) + +diff --git a/grub-core/kern/disk.c b/grub-core/kern/disk.c +index 355b6579d..5747ad85c 100644 +--- a/grub-core/kern/disk.c ++++ b/grub-core/kern/disk.c +@@ -28,6 +28,10 @@ + + #define GRUB_CACHE_TIMEOUT 2 + ++/* Disk reads may trigger other disk reads. So, limit recursion depth. */ ++#define MAX_READ_RECURSION_DEPTH 16 ++static unsigned int read_recursion_depth = 0; ++ + /* The last time the disk was used. */ + static grub_uint64_t grub_last_time = 0; + +@@ -421,6 +425,8 @@ grub_err_t + grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + grub_off_t offset, grub_size_t size, void *buf) + { ++ grub_err_t err = GRUB_ERR_NONE; ++ + /* First of all, check if the region is within the disk. */ + if (grub_disk_adjust_range (disk, §or, &offset, size) != GRUB_ERR_NONE) + { +@@ -431,12 +437,17 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + return grub_errno; + } + ++ if (++read_recursion_depth >= MAX_READ_RECURSION_DEPTH) ++ { ++ grub_error (GRUB_ERR_RECURSION_DEPTH, "grub_disk_read(): Maximum recursion depth exceeded"); ++ goto error; ++ } ++ + /* First read until first cache boundary. */ + if (offset || (sector & (GRUB_DISK_CACHE_SIZE - 1))) + { + grub_disk_addr_t start_sector; + grub_size_t pos; +- grub_err_t err; + grub_size_t len; + + start_sector = sector & ~((grub_disk_addr_t) GRUB_DISK_CACHE_SIZE - 1); +@@ -448,7 +459,7 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + err = grub_disk_read_small (disk, start_sector, + offset + pos, len, buf); + if (err) +- return err; ++ goto error; + buf = (char *) buf + len; + size -= len; + offset += len; +@@ -461,7 +472,6 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + { + char *data = NULL; + grub_disk_addr_t agglomerate; +- grub_err_t err; + + /* agglomerate read until we find a first cached entry. */ + for (agglomerate = 0; agglomerate +@@ -497,7 +507,7 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + - disk->log_sector_size), + buf); + if (err) +- return err; ++ goto error; + + for (i = 0; i < agglomerate; i ++) + grub_disk_cache_store (disk->dev->id, disk->id, +@@ -531,13 +541,16 @@ grub_disk_read (grub_disk_t disk, grub_disk_addr_t sector, + /* And now read the last part. */ + if (size) + { +- grub_err_t err; + err = grub_disk_read_small (disk, sector, 0, size, buf); + if (err) +- return err; ++ goto error; + } + +- return grub_errno; ++ err = grub_errno; ++ ++ error: ++ read_recursion_depth--; ++ return err; + } + + grub_uint64_t +diff --git a/include/grub/err.h b/include/grub/err.h +index 29f1a73c5..7530f58b2 100644 +--- a/include/grub/err.h ++++ b/include/grub/err.h +@@ -74,7 +74,8 @@ typedef enum + GRUB_ERR_EOF, + GRUB_ERR_BAD_SIGNATURE, + GRUB_ERR_BAD_FIRMWARE, +- GRUB_ERR_STILL_REFERENCED ++ GRUB_ERR_STILL_REFERENCED, ++ GRUB_ERR_RECURSION_DEPTH + } + grub_err_t; + diff --git a/0310-kern-partition-Limit-recursion-in-part_iterate.patch b/0310-kern-partition-Limit-recursion-in-part_iterate.patch new file mode 100644 index 00000000..f51ff967 --- /dev/null +++ b/0310-kern-partition-Limit-recursion-in-part_iterate.patch @@ -0,0 +1,44 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sat, 16 Nov 2024 21:24:19 +0000 +Subject: [PATCH] kern/partition: Limit recursion in part_iterate() + +The part_iterate() is used by grub_partition_iterate() as a callback in +the partition iterate functions. However, part_iterate() may also call +the partition iterate functions which may lead to recursion. Fix potential +issue by limiting the recursion depth. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/partition.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c +index edad9f9e4..704512a20 100644 +--- a/grub-core/kern/partition.c ++++ b/grub-core/kern/partition.c +@@ -28,6 +28,9 @@ + + grub_partition_map_t grub_partition_map_list; + ++#define MAX_RECURSION_DEPTH 32 ++static unsigned int recursion_depth = 0; ++ + /* + * Checks that disk->partition contains part. This function assumes that the + * start of part is relative to the start of disk->partition. Returns 1 if +@@ -208,7 +211,12 @@ part_iterate (grub_disk_t dsk, const grub_partition_t partition, void *data) + FOR_PARTITION_MAPS(partmap) + { + grub_err_t err; +- err = partmap->iterate (dsk, part_iterate, ctx); ++ recursion_depth++; ++ if (recursion_depth <= MAX_RECURSION_DEPTH) ++ err = partmap->iterate (dsk, part_iterate, ctx); ++ else ++ err = grub_error (GRUB_ERR_RECURSION_DEPTH, "maximum recursion depth exceeded"); ++ recursion_depth--; + if (err) + grub_errno = GRUB_ERR_NONE; + if (ctx->ret) diff --git a/0311-script-execute-Limit-the-recursion-depth.patch b/0311-script-execute-Limit-the-recursion-depth.patch new file mode 100644 index 00000000..6bf1d092 --- /dev/null +++ b/0311-script-execute-Limit-the-recursion-depth.patch @@ -0,0 +1,55 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 19:04:13 +0100 +Subject: [PATCH] script/execute: Limit the recursion depth + +If unbounded recursion is allowed it becomes possible to collide the +stack with the heap. As UEFI firmware often lacks guard pages this +becomes an exploitable issue as it is possible in some cases to do +a controlled overwrite of a section of this heap region with +arbitrary data. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/script/execute.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index c19b4bf70..7ed3a1a03 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -36,10 +36,18 @@ + is sizeof (int) * 3, and one extra for a possible -ve sign. */ + #define ERRNO_DIGITS_MAX (sizeof (int) * 3 + 1) + ++/* ++ * A limit on recursion, to avoid colliding with the heap. UEFI defines a baseline ++ * stack size of 128 KiB. So, assuming at most 1-2 KiB per iteration this should ++ * keep us safe. ++ */ ++#define MAX_RECURSION_DEPTH 64 ++ + static unsigned long is_continue; + static unsigned long active_loops; + static unsigned long active_breaks; + static unsigned long function_return; ++static unsigned long recursion_depth; + + #define GRUB_SCRIPT_SCOPE_MALLOCED 1 + #define GRUB_SCRIPT_SCOPE_ARGS_MALLOCED 2 +@@ -850,7 +858,13 @@ grub_script_execute_cmd (struct grub_script_cmd *cmd) + if (cmd == 0) + return 0; + ++ recursion_depth++; ++ ++ if (recursion_depth >= MAX_RECURSION_DEPTH) ++ return grub_error (GRUB_ERR_RECURSION_DEPTH, N_("maximum recursion depth exceeded")); ++ + ret = cmd->exec (cmd); ++ recursion_depth--; + + grub_snprintf (errnobuf, sizeof (errnobuf), "%d", ret); + grub_env_set ("?", errnobuf); diff --git a/0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch b/0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch new file mode 100644 index 00000000..c3f5636c --- /dev/null +++ b/0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch @@ -0,0 +1,29 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 15:27:10 -0600 +Subject: [PATCH] net: Unregister net_default_ip and net_default_mac variables + hooks on unload + +The net module is a dependency of normal. So, it shouldn't be possible +to unload the net. Though unregister variables hooks as a precaution. +It also gets in line with unregistering the other net module hooks. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index fdec64d55..9959a2ae8 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -2221,6 +2221,8 @@ GRUB_MOD_FINI(net) + + grub_register_variable_hook ("net_default_server", 0, 0); + grub_register_variable_hook ("pxe_default_server", 0, 0); ++ grub_register_variable_hook ("net_default_ip", 0, 0); ++ grub_register_variable_hook ("net_default_mac", 0, 0); + + grub_bootp_fini (); + grub_dns_fini (); diff --git a/0313-net-Remove-variables-hooks-when-interface-is-unregis.patch b/0313-net-Remove-variables-hooks-when-interface-is-unregis.patch new file mode 100644 index 00000000..c7b25c19 --- /dev/null +++ b/0313-net-Remove-variables-hooks-when-interface-is-unregis.patch @@ -0,0 +1,84 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 15:42:44 -0600 +Subject: [PATCH] net: Remove variables hooks when interface is unregisted + +The grub_net_network_level_interface_unregister(), previously +implemented in a header, did not remove the variables hooks that +were registered in grub_net_network_level_interface_register(). +Fix this by implementing the same logic used to register the +variables and move the function into the grub-core/net/net.c. + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 33 +++++++++++++++++++++++++++++++++ + include/grub/net.h | 11 +---------- + 2 files changed, 34 insertions(+), 10 deletions(-) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 9959a2ae8..22d5cc3ba 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -1066,6 +1066,39 @@ grub_net_add_ipv6_local (struct grub_net_network_level_interface *inter, + return 0; + } + ++void ++grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter) ++{ ++ char *name; ++ ++ { ++ char buf[GRUB_NET_MAX_STR_HWADDR_LEN]; ++ ++ grub_net_hwaddr_to_str (&inter->hwaddress, buf); ++ name = grub_xasprintf ("net_%s_mac", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } ++ ++ { ++ char buf[GRUB_NET_MAX_STR_ADDR_LEN]; ++ ++ grub_net_addr_to_str (&inter->address, buf); ++ name = grub_xasprintf ("net_%s_ip", inter->name); ++ if (name != NULL) ++ grub_register_variable_hook (name, NULL, NULL); ++ grub_free (name); ++ } ++ ++ inter->card->num_ifaces--; ++ *inter->prev = inter->next; ++ if (inter->next) ++ inter->next->prev = inter->prev; ++ inter->next = 0; ++ inter->prev = 0; ++} ++ + grub_err_t + grub_net_add_ipv4_local (struct grub_net_network_level_interface *inter, + int mask) +diff --git a/include/grub/net.h b/include/grub/net.h +index 868c9a2ef..273afbddf 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -625,16 +625,7 @@ void grub_bootp_fini (void); + void grub_dns_init (void); + void grub_dns_fini (void); + +-static inline void +-grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter) +-{ +- inter->card->num_ifaces--; +- *inter->prev = inter->next; +- if (inter->next) +- inter->next->prev = inter->prev; +- inter->next = 0; +- inter->prev = 0; +-} ++void grub_net_network_level_interface_unregister (struct grub_net_network_level_interface *inter); + + void + grub_net_tcp_retransmit (void); diff --git a/0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch b/0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch new file mode 100644 index 00000000..d0830c83 --- /dev/null +++ b/0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch @@ -0,0 +1,79 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 16:38:44 -0600 +Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file() + +The function included a call to grub_strcpy() which copied data from an +environment variable to a buffer allocated in grub_cmd_normal(). The +grub_cmd_normal() didn't consider the length of the environment variable. +So, the copy operation could exceed the allocation and lead to an OOB +write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and +pass the underlying buffers size to the grub_net_search_config_file(). + +Fixes: CVE-2025-0624 + +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 7 ++++--- + grub-core/normal/main.c | 2 +- + include/grub/net.h | 2 +- + 3 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 22d5cc3ba..6c8dfcba2 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -2023,14 +2023,15 @@ grub_config_search_through (char *config, char *suffix, + } + + grub_err_t +-grub_net_search_config_file (char *config) ++grub_net_search_config_file (char *config, grub_size_t config_buf_len) + { +- grub_size_t config_len; ++ grub_size_t config_len, suffix_len; + char *suffix; + + config_len = grub_strlen (config); + config[config_len] = '-'; + suffix = config + config_len + 1; ++ suffix_len = config_buf_len - (config_len + 1); + + struct grub_net_network_level_interface *inf; + FOR_NET_NETWORK_LEVEL_INTERFACES (inf) +@@ -2056,7 +2057,7 @@ grub_net_search_config_file (char *config) + + if (client_uuid) + { +- grub_strcpy (suffix, client_uuid); ++ grub_strlcpy (suffix, client_uuid, suffix_len); + if (grub_config_search_through (config, suffix, 1, 0) == 0) + return GRUB_ERR_NONE; + } +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index 86ffb388d..cad840e06 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -360,7 +360,7 @@ grub_try_normal_prefix (const char *prefix) + return err; + + grub_snprintf (config, config_len, "%s/grub.cfg", prefix); +- err = grub_net_search_config_file (config); ++ err = grub_net_search_config_file (config, config_len); + } + + if (err != GRUB_ERR_NONE) +diff --git a/include/grub/net.h b/include/grub/net.h +index 273afbddf..d280acd72 100644 +--- a/include/grub/net.h ++++ b/include/grub/net.h +@@ -655,7 +655,7 @@ void + grub_net_remove_dns_server (const struct grub_net_network_level_address *s); + + grub_err_t +-grub_net_search_config_file (char *config); ++grub_net_search_config_file (char *config, grub_size_t config_buf_len); + + extern char *grub_net_default_server; + diff --git a/0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch b/0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch new file mode 100644 index 00000000..91b857d8 --- /dev/null +++ b/0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch @@ -0,0 +1,115 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 17:32:34 +0100 +Subject: [PATCH] net/tftp: Fix stack buffer overflow in tftp_open() + +An overly long filename can be passed to tftp_open() which would cause +grub_normalize_filename() to write out of bounds. + +Fixed by adding an extra argument to grub_normalize_filename() for the +space available, making it act closer to a strlcpy(). As several fixed +strings are strcpy()'d after into the same buffer, their total length is +checked to see if they exceed the remaining space in the buffer. If so, +return an error. + +On the occasion simplify code a bit by removing unneeded rrqlen zeroing. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/net/tftp.c | 38 ++++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c +index f300a9d40..3d96e50f4 100644 +--- a/grub-core/net/tftp.c ++++ b/grub-core/net/tftp.c +@@ -266,17 +266,19 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)), + * forward slashes to a single forward slash. + */ + static void +-grub_normalize_filename (char *normalized, const char *filename) ++grub_normalize_filename (char *normalized, const char *filename, int c) + { + char *dest = normalized; + const char *src = filename; + +- while (*src != '\0') ++ while (*src != '\0' && c > 0) + { + if (src[0] == '/' && src[1] == '/') + src++; +- else ++ else { ++ c--; + *dest++ = *src++; ++ } + } + *dest = '\0'; + } +@@ -287,7 +289,7 @@ tftp_open (struct grub_file *file, const char *filename) + struct tftphdr *tftph; + char *rrq; + int i; +- int rrqlen; ++ int rrqlen, rrqsize; + int hdrlen; + grub_uint8_t open_data[1500]; + struct grub_net_buff nb; +@@ -315,37 +317,45 @@ tftp_open (struct grub_file *file, const char *filename) + + tftph = (struct tftphdr *) nb.data; + +- rrq = (char *) tftph->u.rrq; +- rrqlen = 0; +- + tftph->opcode = grub_cpu_to_be16_compile_time (TFTP_RRQ); + ++ rrq = (char *) tftph->u.rrq; ++ rrqsize = sizeof (tftph->u.rrq); ++ + /* + * Copy and normalize the filename to work-around issues on some TFTP + * servers when file names are being matched for remapping. + */ +- grub_normalize_filename (rrq, filename); +- rrqlen += grub_strlen (rrq) + 1; ++ grub_normalize_filename (rrq, filename, rrqsize); ++ ++ rrqlen = grub_strlen (rrq) + 1; + rrq += grub_strlen (rrq) + 1; + +- grub_strcpy (rrq, "octet"); ++ /* Verify there is enough space for the remaining components. */ + rrqlen += grub_strlen ("octet") + 1; ++ rrqlen += grub_strlen ("blksize") + 1; ++ rrqlen += grub_strlen ("1024") + 1; ++ rrqlen += grub_strlen ("tsize") + 1; ++ rrqlen += grub_strlen ("0") + 1; ++ ++ if (rrqlen >= rrqsize) { ++ grub_free (data); ++ return grub_error (GRUB_ERR_BAD_FILENAME, N_("filename too long")); ++ } ++ ++ grub_strcpy (rrq, "octet"); + rrq += grub_strlen ("octet") + 1; + + grub_strcpy (rrq, "blksize"); +- rrqlen += grub_strlen ("blksize") + 1; + rrq += grub_strlen ("blksize") + 1; + + grub_strcpy (rrq, "1024"); +- rrqlen += grub_strlen ("1024") + 1; + rrq += grub_strlen ("1024") + 1; + + grub_strcpy (rrq, "tsize"); +- rrqlen += grub_strlen ("tsize") + 1; + rrq += grub_strlen ("tsize") + 1; + + grub_strcpy (rrq, "0"); +- rrqlen += grub_strlen ("0") + 1; + rrq += grub_strlen ("0") + 1; + hdrlen = sizeof (tftph->opcode) + rrqlen; + diff --git a/0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch b/0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch new file mode 100644 index 00000000..848d527f --- /dev/null +++ b/0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Fri, 8 Mar 2024 22:47:20 +1100 +Subject: [PATCH] video/readers/jpeg: Do not permit duplicate SOF0 markers in + JPEG + +Otherwise a subsequent header could change the height and width +allowing future OOB writes. + +Fixes: CVE-2024-45774 + +Reported-by: Nils Langius +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/video/readers/jpeg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c +index ae634fd41..631a89356 100644 +--- a/grub-core/video/readers/jpeg.c ++++ b/grub-core/video/readers/jpeg.c +@@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data) + if (grub_errno != GRUB_ERR_NONE) + return grub_errno; + ++ if (data->image_height != 0 || data->image_width != 0) ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, ++ "jpeg: cannot have duplicate SOF0 markers"); ++ + if (grub_jpeg_get_byte (data) != 8) + return grub_error (GRUB_ERR_BAD_FILE_TYPE, + "jpeg: only 8-bit precision is supported"); diff --git a/0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch b/0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch new file mode 100644 index 00000000..1fee4bf0 --- /dev/null +++ b/0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch @@ -0,0 +1,138 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 16:41:57 -0600 +Subject: [PATCH] kern/dl: Fix for an integer overflow in grub_dl_ref() + +It was possible to overflow the value of mod->ref_count, a signed +integer, by repeatedly invoking insmod on an already loaded module. +This led to a use-after-free. As once ref_count was overflowed it became +possible to unload the module while there was still references to it. + +This resolves the issue by using grub_add() to check if the ref_count +will overflow and then stops further increments. Further changes were +also made to grub_dl_unref() to check for the underflow condition and +the reference count was changed to an unsigned 64-bit integer. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/minicmd.c | 2 +- + grub-core/kern/dl.c | 17 ++++++++++++----- + include/grub/dl.h | 8 ++++---- + util/misc.c | 4 ++-- + 4 files changed, 19 insertions(+), 12 deletions(-) + +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index 2bd3ac76f..2001043cf 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -167,7 +167,7 @@ grub_mini_cmd_lsmod (struct grub_command *cmd __attribute__ ((unused)), + { + grub_dl_dep_t dep; + +- grub_printf ("%s\t%d\t\t", mod->name, mod->ref_count); ++ grub_printf ("%s\t%" PRIuGRUB_UINT64_T "\t\t", mod->name, mod->ref_count); + for (dep = mod->dep; dep; dep = dep->next) + { + if (dep != mod->dep) +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index 2eaef7150..fe7c3b940 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #include + + /* Platforms where modules are in a readonly area of memory. */ +@@ -613,7 +614,7 @@ grub_dl_resolve_dependencies (grub_dl_t mod, Elf_Ehdr *e) + return GRUB_ERR_NONE; + } + +-int ++grub_uint64_t + grub_dl_ref (grub_dl_t mod) + { + grub_dl_dep_t dep; +@@ -624,10 +625,13 @@ grub_dl_ref (grub_dl_t mod) + for (dep = mod->dep; dep; dep = dep->next) + grub_dl_ref (dep->mod); + +- return ++mod->ref_count; ++ if (grub_add (mod->ref_count, 1, &mod->ref_count)) ++ grub_fatal ("Module reference count overflow"); ++ ++ return mod->ref_count; + } + +-int ++grub_uint64_t + grub_dl_unref (grub_dl_t mod) + { + grub_dl_dep_t dep; +@@ -638,10 +642,13 @@ grub_dl_unref (grub_dl_t mod) + for (dep = mod->dep; dep; dep = dep->next) + grub_dl_unref (dep->mod); + +- return --mod->ref_count; ++ if (grub_sub (mod->ref_count, 1, &mod->ref_count)) ++ grub_fatal ("Module reference count underflow"); ++ ++ return mod->ref_count; + } + +-int ++grub_uint64_t + grub_dl_ref_count (grub_dl_t mod) + { + if (mod == NULL) +diff --git a/include/grub/dl.h b/include/grub/dl.h +index 1e1262a28..055bb564e 100644 +--- a/include/grub/dl.h ++++ b/include/grub/dl.h +@@ -177,7 +177,7 @@ typedef struct grub_dl_dep *grub_dl_dep_t; + struct grub_dl + { + char *name; +- int ref_count; ++ grub_uint64_t ref_count; + int persistent; + grub_dl_dep_t dep; + grub_dl_segment_t segment; +@@ -206,9 +206,9 @@ grub_dl_t EXPORT_FUNC(grub_dl_load) (const char *name); + grub_dl_t grub_dl_load_core (void *addr, grub_size_t size); + grub_dl_t EXPORT_FUNC(grub_dl_load_core_noinit) (void *addr, grub_size_t size); + int EXPORT_FUNC(grub_dl_unload) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod); +-extern int EXPORT_FUNC(grub_dl_ref_count) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod); ++extern grub_uint64_t EXPORT_FUNC(grub_dl_ref_count) (grub_dl_t mod); + + extern grub_dl_t EXPORT_VAR(grub_dl_head); + +diff --git a/util/misc.c b/util/misc.c +index d545212d9..0f928e5b4 100644 +--- a/util/misc.c ++++ b/util/misc.c +@@ -190,14 +190,14 @@ grub_xputs_real (const char *str) + + void (*grub_xputs) (const char *str) = grub_xputs_real; + +-int ++grub_uint64_t + grub_dl_ref (grub_dl_t mod) + { + (void) mod; + return 0; + } + +-int ++grub_uint64_t + grub_dl_unref (grub_dl_t mod) + { + (void) mod; diff --git a/0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch b/0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch new file mode 100644 index 00000000..213ef199 --- /dev/null +++ b/0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 17:01:26 -0600 +Subject: [PATCH] kern/dl: Check for the SHF_INFO_LINK flag in + grub_dl_relocate_symbols() + +The grub_dl_relocate_symbols() iterates through the sections in +an ELF looking for relocation sections. According to the spec [1] +the SHF_INFO_LINK flag should be set if the sh_info field is meant +to be a section index. + +[1] https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/kern/dl.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c +index fe7c3b940..cb49bdc4b 100644 +--- a/grub-core/kern/dl.c ++++ b/grub-core/kern/dl.c +@@ -681,6 +681,9 @@ grub_dl_relocate_symbols (grub_dl_t mod, void *ehdr) + grub_dl_segment_t seg; + grub_err_t err; + ++ if (!(s->sh_flags & SHF_INFO_LINK)) ++ continue; ++ + seg = grub_dl_find_segment(mod, s->sh_info); + if (!seg) + continue; diff --git a/0319-commands-extcmd-Missing-check-for-failed-allocation.patch b/0319-commands-extcmd-Missing-check-for-failed-allocation.patch new file mode 100644 index 00000000..44e8c915 --- /dev/null +++ b/0319-commands-extcmd-Missing-check-for-failed-allocation.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:55 +0000 +Subject: [PATCH] commands/extcmd: Missing check for failed allocation + +The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate +a grub_arg_list struct but it does not verify the allocation was successful. +In case of failed allocation the NULL state pointer can be accessed in +parse_option() through grub_arg_parse() which may lead to a security issue. + +Fixes: CVE-2024-45775 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/commands/extcmd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c +index 90a5ca24a..c236be13a 100644 +--- a/grub-core/commands/extcmd.c ++++ b/grub-core/commands/extcmd.c +@@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args, + } + + state = grub_arg_list_alloc (ext, argc, args); ++ if (state == NULL) ++ return grub_errno; ++ + if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc)) + { + context.state = state; diff --git a/0320-commands-ls-Fix-NULL-dereference.patch b/0320-commands-ls-Fix-NULL-dereference.patch new file mode 100644 index 00000000..c58177b7 --- /dev/null +++ b/0320-commands-ls-Fix-NULL-dereference.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Sun, 12 May 2024 11:08:23 +0100 +Subject: [PATCH] commands/ls: Fix NULL dereference + +The grub_strrchr() may return NULL when the dirname do not contain "/". +This can happen on broken filesystems. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/ls.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/ls.c b/grub-core/commands/ls.c +index 6a1c7f5d3..f660946a2 100644 +--- a/grub-core/commands/ls.c ++++ b/grub-core/commands/ls.c +@@ -241,7 +241,11 @@ grub_ls_list_files (char *dirname, int longlist, int all, int human) + + grub_file_close (file); + +- p = grub_strrchr (dirname, '/') + 1; ++ p = grub_strrchr (dirname, '/'); ++ if (p == NULL) ++ goto fail; ++ ++p; ++ + ctx.dirname = grub_strndup (dirname, p - dirname); + if (ctx.dirname == NULL) + goto fail; diff --git a/0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch b/0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch new file mode 100644 index 00000000..8305f909 --- /dev/null +++ b/0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 19:24:29 +0000 +Subject: [PATCH] commands/pgp: Unregister the "check_signatures" hooks on + module unload + +If the hooks are not removed they can be called after the module has +been unloaded leading to an use-after-free. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/pgp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c +index 847a5046a..fa3ef5c75 100644 +--- a/grub-core/commands/pgp.c ++++ b/grub-core/commands/pgp.c +@@ -982,6 +982,8 @@ GRUB_MOD_INIT(pgp) + + GRUB_MOD_FINI(pgp) + { ++ grub_register_variable_hook ("check_signatures", NULL, NULL); ++ grub_env_unset ("check_signatures"); + grub_verifier_unregister (&grub_pubkey_verifier); + grub_unregister_extcmd (cmd); + grub_unregister_extcmd (cmd_trust); diff --git a/0322-normal-Remove-variables-hooks-on-module-unload.patch b/0322-normal-Remove-variables-hooks-on-module-unload.patch new file mode 100644 index 00000000..d730194a --- /dev/null +++ b/0322-normal-Remove-variables-hooks-on-module-unload.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 23:46:55 +0000 +Subject: [PATCH] normal: Remove variables hooks on module unload + +The normal module does not entirely cleanup after itself in +its GRUB_MOD_FINI() leaving a few variables hooks in place. +It is not possible to unload normal module now but fix the +issues for completeness. + +On the occasion replace 0s with NULLs for "pager" variable +hooks unregister. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/normal/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index cad840e06..dd20e5129 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -690,7 +690,9 @@ GRUB_MOD_FINI(normal) + grub_xputs = grub_xputs_saved; + + grub_set_history (0); +- grub_register_variable_hook ("pager", 0, 0); ++ grub_register_variable_hook ("pager", NULL, NULL); ++ grub_register_variable_hook ("color_normal", NULL, NULL); ++ grub_register_variable_hook ("color_highlight", NULL, NULL); + grub_fs_autoload_hook = 0; + grub_unregister_command (cmd_clear); + } diff --git a/0323-gettext-Remove-variables-hooks-on-module-unload.patch b/0323-gettext-Remove-variables-hooks-on-module-unload.patch new file mode 100644 index 00000000..9cc952ee --- /dev/null +++ b/0323-gettext-Remove-variables-hooks-on-module-unload.patch @@ -0,0 +1,34 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 1 Nov 2024 23:52:06 +0000 +Subject: [PATCH] gettext: Remove variables hooks on module unload + +The gettext module does not entirely cleanup after itself in +its GRUB_MOD_FINI() leaving a few variables hooks in place. +It is not possible to unload gettext module because normal +module depends on it. Though fix the issues for completeness. + +Fixes: CVE-2025-0622 + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/gettext/gettext.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 631af7a94..465143cb6 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -542,6 +542,10 @@ GRUB_MOD_INIT (gettext) + + GRUB_MOD_FINI (gettext) + { ++ grub_register_variable_hook ("locale_dir", NULL, NULL); ++ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL); ++ grub_register_variable_hook ("lang", NULL, NULL); ++ + grub_gettext_delete_list (&main_context); + grub_gettext_delete_list (&secondary_context); + diff --git a/0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch b/0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch new file mode 100644 index 00000000..d8db5c15 --- /dev/null +++ b/0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:56 +0000 +Subject: [PATCH] gettext: Integer overflow leads to heap OOB write or read + +Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may +overflow leading to subsequent OOB write or read. This patch fixes the +issue by replacing grub_zalloc() and explicit multiplication with +grub_calloc() which does the same thing in safe manner. + +Fixes: CVE-2024-45776 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/gettext/gettext.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 465143cb6..c17040269 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx, + for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log; + ctx->grub_gettext_max_log++); + +- ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max +- * sizeof (ctx->grub_gettext_msg_list[0])); ++ ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max, ++ sizeof (ctx->grub_gettext_msg_list[0])); + if (!ctx->grub_gettext_msg_list) + { + grub_file_close (fd); diff --git a/0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch b/0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch new file mode 100644 index 00000000..5b22d585 --- /dev/null +++ b/0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch @@ -0,0 +1,53 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Fri, 22 Nov 2024 06:27:57 +0000 +Subject: [PATCH] gettext: Integer overflow leads to heap OOB write + +The size calculation of the translation buffer in +grub_gettext_getstr_from_position() may overflow +to 0 leading to heap OOB write. This patch fixes +the issue by using grub_add() and checking for +an overflow. + +Fixes: CVE-2024-45777 + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Alec Brown +--- + grub-core/gettext/gettext.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index c17040269..fffe3a054 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -99,6 +100,7 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx, + char *translation; + struct string_descriptor desc; + grub_err_t err; ++ grub_size_t alloc_sz; + + internal_position = (off + position * sizeof (desc)); + +@@ -109,7 +111,10 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx, + length = grub_cpu_to_le32 (desc.length); + offset = grub_cpu_to_le32 (desc.offset); + +- translation = grub_malloc (length + 1); ++ if (grub_add (length, 1, &alloc_sz)) ++ return NULL; ++ ++ translation = grub_malloc (alloc_sz); + if (!translation) + return NULL; + diff --git a/0326-commands-read-Fix-an-integer-overflow-when-supplying.patch b/0326-commands-read-Fix-an-integer-overflow-when-supplying.patch new file mode 100644 index 00000000..33ea08dd --- /dev/null +++ b/0326-commands-read-Fix-an-integer-overflow-when-supplying.patch @@ -0,0 +1,69 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jonathan Bar Or +Date: Thu, 23 Jan 2025 19:17:05 +0100 +Subject: [PATCH] commands/read: Fix an integer overflow when supplying more + than 2^31 characters + +The grub_getline() function currently has a signed integer variable "i" +that can be overflown when user supplies more than 2^31 characters. +It results in a memory corruption of the allocated line buffer as well +as supplying large negative values to grub_realloc(). + +Fixes: CVE-2025-0690 + +Reported-by: Jonathan Bar Or +Signed-off-by: Jonathan Bar Or +Reviewed-by: Daniel Kiper +--- + grub-core/commands/read.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c +index 597c90706..8d72e45c9 100644 +--- a/grub-core/commands/read.c ++++ b/grub-core/commands/read.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -37,13 +38,14 @@ static const struct grub_arg_option options[] = + static char * + grub_getline (int silent) + { +- int i; ++ grub_size_t i; + char *line; + char *tmp; + int c; ++ grub_size_t alloc_size; + + i = 0; +- line = grub_malloc (1 + i + sizeof('\0')); ++ line = grub_malloc (1 + sizeof('\0')); + if (! line) + return NULL; + +@@ -59,8 +61,17 @@ grub_getline (int silent) + line[i] = (char) c; + if (!silent) + grub_printf ("%c", c); +- i++; +- tmp = grub_realloc (line, 1 + i + sizeof('\0')); ++ if (grub_add (i, 1, &i)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ if (grub_add (i, 1 + sizeof('\0'), &alloc_size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ return NULL; ++ } ++ tmp = grub_realloc (line, alloc_size); + if (! tmp) + { + grub_free (line); diff --git a/0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch b/0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch new file mode 100644 index 00000000..3dc101b1 --- /dev/null +++ b/0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch @@ -0,0 +1,83 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Mon, 16 Dec 2024 20:22:41 +0000 +Subject: [PATCH] commands/test: Stack overflow due to unlimited recursion + depth + +The test_parse() evaluates test expression recursively. Due to lack of +recursion depth check a specially crafted expression may cause a stack +overflow. The recursion is only triggered by the parentheses usage and +it can be unlimited. However, sensible expressions are unlikely to +contain more than a few parentheses. So, this patch limits the recursion +depth to 100, which should be sufficient. + +Reported-by: Nils Langius +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/commands/test.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/grub-core/commands/test.c b/grub-core/commands/test.c +index 62d3fb398..b585c3d70 100644 +--- a/grub-core/commands/test.c ++++ b/grub-core/commands/test.c +@@ -29,6 +29,9 @@ + + GRUB_MOD_LICENSE ("GPLv3+"); + ++/* Set a limit on recursion to avoid stack overflow. */ ++#define MAX_TEST_RECURSION_DEPTH 100 ++ + /* A simple implementation for signed numbers. */ + static int + grub_strtosl (char *arg, const char ** const end, int base) +@@ -150,7 +153,7 @@ get_fileinfo (char *path, struct test_parse_ctx *ctx) + + /* Parse a test expression starting from *argn. */ + static int +-test_parse (char **args, int *argn, int argc) ++test_parse (char **args, int *argn, int argc, int *depth) + { + struct test_parse_ctx ctx = { + .and = 1, +@@ -387,13 +390,24 @@ test_parse (char **args, int *argn, int argc) + if (grub_strcmp (args[*argn], ")") == 0) + { + (*argn)++; ++ if (*depth > 0) ++ (*depth)--; ++ + return ctx.or || ctx.and; + } + /* Recursively invoke if parenthesis. */ + if (grub_strcmp (args[*argn], "(") == 0) + { + (*argn)++; +- update_val (test_parse (args, argn, argc), &ctx); ++ ++ if (++(*depth) > MAX_TEST_RECURSION_DEPTH) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("max recursion depth exceeded")); ++ depth--; ++ return ctx.or || ctx.and; ++ } ++ ++ update_val (test_parse (args, argn, argc, depth), &ctx); + continue; + } + +@@ -428,11 +442,12 @@ grub_cmd_test (grub_command_t cmd __attribute__ ((unused)), + int argc, char **args) + { + int argn = 0; ++ int depth = 0; + + if (argc >= 1 && grub_strcmp (args[argc - 1], "]") == 0) + argc--; + +- return test_parse (args, &argn, argc) ? GRUB_ERR_NONE ++ return test_parse (args, &argn, argc, &depth) ? GRUB_ERR_NONE + : grub_error (GRUB_ERR_TEST_FAILURE, N_("false")); + } + diff --git a/0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch b/0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch new file mode 100644 index 00000000..a9991461 --- /dev/null +++ b/0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch @@ -0,0 +1,33 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Thu, 18 Apr 2024 20:29:39 +0100 +Subject: [PATCH] commands/minicmd: Block the dump command in lockdown mode + +The dump enables a user to read memory which should not be possible +in lockdown mode. + +Fixes: CVE-2025-1118 + +Reported-by: B Horn +Reported-by: Jonathan Bar Or +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/minicmd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c +index 2001043cf..9efb7718c 100644 +--- a/grub-core/commands/minicmd.c ++++ b/grub-core/commands/minicmd.c +@@ -215,8 +215,8 @@ GRUB_MOD_INIT(minicmd) + grub_register_command ("help", grub_mini_cmd_help, + 0, N_("Show this message.")); + cmd_dump = +- grub_register_command ("dump", grub_mini_cmd_dump, +- N_("ADDR [SIZE]"), N_("Show memory contents.")); ++ grub_register_command_lockdown ("dump", grub_mini_cmd_dump, ++ N_("ADDR [SIZE]"), N_("Show memory contents.")); + cmd_rmmod = + grub_register_command ("rmmod", grub_mini_cmd_rmmod, + N_("MODULE"), N_("Remove a module.")); diff --git a/0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch b/0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch new file mode 100644 index 00000000..e787d6f7 --- /dev/null +++ b/0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch @@ -0,0 +1,50 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Tue, 11 Feb 2025 17:12:29 -0600 +Subject: [PATCH] commands/memrw: Disable memory reading in lockdown mode + +With the rest of module being blocked in lockdown mode it does not make +a lot of sense to leave memory reading enabled. This also goes in par +with disabling the dump command. + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/memrw.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/grub-core/commands/memrw.c b/grub-core/commands/memrw.c +index 39cf3a06d..9d8a54a4b 100644 +--- a/grub-core/commands/memrw.c ++++ b/grub-core/commands/memrw.c +@@ -126,17 +126,20 @@ GRUB_MOD_INIT(memrw) + return; + + cmd_read_byte = +- grub_register_extcmd ("read_byte", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 8-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_byte", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 8-bit value from ADDR."), ++ options); + cmd_read_word = +- grub_register_extcmd ("read_word", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 16-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_word", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 16-bit value from ADDR."), ++ options); + cmd_read_dword = +- grub_register_extcmd ("read_dword", grub_cmd_read, 0, +- N_("ADDR"), N_("Read 32-bit value from ADDR."), +- options); ++ grub_register_extcmd_lockdown ("read_dword", grub_cmd_read, 0, ++ N_("ADDR"), ++ N_("Read 32-bit value from ADDR."), ++ options); + cmd_write_byte = + grub_register_command_lockdown ("write_byte", grub_cmd_write, + N_("ADDR VALUE [MASK]"), diff --git a/0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch b/0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch new file mode 100644 index 00000000..ae523f80 --- /dev/null +++ b/0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch @@ -0,0 +1,37 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: B Horn +Date: Fri, 19 Apr 2024 22:31:45 +0100 +Subject: [PATCH] commands/hexdump: Disable memory reading in lockdown mode + +Reported-by: B Horn +Signed-off-by: B Horn +Reviewed-by: Daniel Kiper +--- + grub-core/commands/hexdump.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/hexdump.c b/grub-core/commands/hexdump.c +index eaa12465b..d6f61d98a 100644 +--- a/grub-core/commands/hexdump.c ++++ b/grub-core/commands/hexdump.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -51,7 +52,11 @@ grub_cmd_hexdump (grub_extcmd_context_t ctxt, int argc, char **args) + length = (state[1].set) ? grub_strtoul (state[1].arg, 0, 0) : 256; + + if (!grub_strcmp (args[0], "(mem)")) +- hexdump (skip, (char *) (grub_addr_t) skip, length); ++ { ++ if (grub_is_lockdown() == GRUB_LOCKDOWN_ENABLED) ++ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("memory reading is disabled in lockdown mode")); ++ hexdump (skip, (char *) (grub_addr_t) skip, length); ++ } + else if ((args[0][0] == '(') && (args[0][namelen - 1] == ')')) + { + grub_disk_t disk; diff --git a/0331-fs-bfs-Disable-under-lockdown.patch b/0331-fs-bfs-Disable-under-lockdown.patch new file mode 100644 index 00000000..c8364628 --- /dev/null +++ b/0331-fs-bfs-Disable-under-lockdown.patch @@ -0,0 +1,52 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Sat, 23 Mar 2024 15:59:43 +1100 +Subject: [PATCH] fs/bfs: Disable under lockdown + +The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown. +This will also disable the AFS. + +Fixes: CVE-2024-45778 +Fixes: CVE-2024-45779 + +Reported-by: Nils Langius +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/fs/bfs.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c +index f37b16895..c92fd7916 100644 +--- a/grub-core/fs/bfs.c ++++ b/grub-core/fs/bfs.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1106,8 +1107,11 @@ GRUB_MOD_INIT (bfs) + { + COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == + sizeof (struct grub_bfs_extent)); +- grub_bfs_fs.mod = mod; +- grub_fs_register (&grub_bfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_bfs_fs.mod = mod; ++ grub_fs_register (&grub_bfs_fs); ++ } + } + + #ifdef MODE_AFS +@@ -1116,5 +1120,6 @@ GRUB_MOD_FINI (afs) + GRUB_MOD_FINI (bfs) + #endif + { +- grub_fs_unregister (&grub_bfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_bfs_fs); + } diff --git a/0332-fs-Disable-many-filesystems-under-lockdown.patch b/0332-fs-Disable-many-filesystems-under-lockdown.patch new file mode 100644 index 00000000..edd6c407 --- /dev/null +++ b/0332-fs-Disable-many-filesystems-under-lockdown.patch @@ -0,0 +1,391 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Daniel Axtens +Date: Sat, 23 Mar 2024 16:20:45 +1100 +Subject: [PATCH] fs: Disable many filesystems under lockdown + +The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat, +hfsplus, iso9660, squash4, tar, xfs and zfs. + +The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were +reported by Jonathan Bar Or . + +Fixes: CVE-2025-0677 +Fixes: CVE-2025-0684 +Fixes: CVE-2025-0685 +Fixes: CVE-2025-0686 +Fixes: CVE-2025-0689 + +Suggested-by: Daniel Axtens +Signed-off-by: Daniel Axtens +Reviewed-by: Daniel Kiper +--- + grub-core/fs/affs.c | 11 ++++++++--- + grub-core/fs/cbfs.c | 11 ++++++++--- + grub-core/fs/jfs.c | 11 ++++++++--- + grub-core/fs/minix.c | 11 ++++++++--- + grub-core/fs/nilfs2.c | 11 ++++++++--- + grub-core/fs/ntfs.c | 11 ++++++++--- + grub-core/fs/reiserfs.c | 11 ++++++++--- + grub-core/fs/romfs.c | 11 ++++++++--- + grub-core/fs/sfs.c | 11 ++++++++--- + grub-core/fs/udf.c | 11 ++++++++--- + grub-core/fs/ufs.c | 11 ++++++++--- + 11 files changed, 88 insertions(+), 33 deletions(-) + +diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c +index 9b0afb954..520a001c7 100644 +--- a/grub-core/fs/affs.c ++++ b/grub-core/fs/affs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -703,12 +704,16 @@ static struct grub_fs grub_affs_fs = + + GRUB_MOD_INIT(affs) + { +- grub_affs_fs.mod = mod; +- grub_fs_register (&grub_affs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_affs_fs.mod = mod; ++ grub_fs_register (&grub_affs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(affs) + { +- grub_fs_unregister (&grub_affs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_affs_fs); + } +diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c +index 2332745fe..b62c8777c 100644 +--- a/grub-core/fs/cbfs.c ++++ b/grub-core/fs/cbfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -390,13 +391,17 @@ GRUB_MOD_INIT (cbfs) + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + init_cbfsdisk (); + #endif +- grub_cbfs_fs.mod = mod; +- grub_fs_register (&grub_cbfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_cbfs_fs.mod = mod; ++ grub_fs_register (&grub_cbfs_fs); ++ } + } + + GRUB_MOD_FINI (cbfs) + { +- grub_fs_unregister (&grub_cbfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_cbfs_fs); + #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN) + fini_cbfsdisk (); + #endif +diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c +index b0283ac00..ab175c7f1 100644 +--- a/grub-core/fs/jfs.c ++++ b/grub-core/fs/jfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1005,12 +1006,16 @@ static struct grub_fs grub_jfs_fs = + + GRUB_MOD_INIT(jfs) + { +- grub_jfs_fs.mod = mod; +- grub_fs_register (&grub_jfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_jfs_fs.mod = mod; ++ grub_fs_register (&grub_jfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(jfs) + { +- grub_fs_unregister (&grub_jfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_jfs_fs); + } +diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c +index b7679c3e2..4440fcca8 100644 +--- a/grub-core/fs/minix.c ++++ b/grub-core/fs/minix.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -734,8 +735,11 @@ GRUB_MOD_INIT(minix) + #endif + #endif + { +- grub_minix_fs.mod = mod; +- grub_fs_register (&grub_minix_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_minix_fs.mod = mod; ++ grub_fs_register (&grub_minix_fs); ++ } + my_mod = mod; + } + +@@ -757,5 +761,6 @@ GRUB_MOD_FINI(minix) + #endif + #endif + { +- grub_fs_unregister (&grub_minix_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_minix_fs); + } +diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c +index 4e1e71738..26e6077ff 100644 +--- a/grub-core/fs/nilfs2.c ++++ b/grub-core/fs/nilfs2.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1231,12 +1232,16 @@ GRUB_MOD_INIT (nilfs2) + grub_nilfs2_dat_entry)); + COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE + == sizeof (struct grub_nilfs2_inode)); +- grub_nilfs2_fs.mod = mod; +- grub_fs_register (&grub_nilfs2_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_nilfs2_fs.mod = mod; ++ grub_fs_register (&grub_nilfs2_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (nilfs2) + { +- grub_fs_unregister (&grub_nilfs2_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_nilfs2_fs); + } +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index 4e144cc3c..e00349b1d 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1541,12 +1542,16 @@ static struct grub_fs grub_ntfs_fs = + + GRUB_MOD_INIT (ntfs) + { +- grub_ntfs_fs.mod = mod; +- grub_fs_register (&grub_ntfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_ntfs_fs.mod = mod; ++ grub_fs_register (&grub_ntfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (ntfs) + { +- grub_fs_unregister (&grub_ntfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_ntfs_fs); + } +diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c +index e8b0b6383..ca47e0a43 100644 +--- a/grub-core/fs/reiserfs.c ++++ b/grub-core/fs/reiserfs.c +@@ -39,6 +39,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -1407,12 +1408,16 @@ static struct grub_fs grub_reiserfs_fs = + + GRUB_MOD_INIT(reiserfs) + { +- grub_reiserfs_fs.mod = mod; +- grub_fs_register (&grub_reiserfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_reiserfs_fs.mod = mod; ++ grub_fs_register (&grub_reiserfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(reiserfs) + { +- grub_fs_unregister (&grub_reiserfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_reiserfs_fs); + } +diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c +index 56b0b2b2f..eafab03b2 100644 +--- a/grub-core/fs/romfs.c ++++ b/grub-core/fs/romfs.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -475,11 +476,15 @@ static struct grub_fs grub_romfs_fs = + + GRUB_MOD_INIT(romfs) + { +- grub_romfs_fs.mod = mod; +- grub_fs_register (&grub_romfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_romfs_fs.mod = mod; ++ grub_fs_register (&grub_romfs_fs); ++ } + } + + GRUB_MOD_FINI(romfs) + { +- grub_fs_unregister (&grub_romfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_romfs_fs); + } +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index f0d7cac43..88705b3a2 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + + GRUB_MOD_LICENSE ("GPLv3+"); +@@ -779,12 +780,16 @@ static struct grub_fs grub_sfs_fs = + + GRUB_MOD_INIT(sfs) + { +- grub_sfs_fs.mod = mod; +- grub_fs_register (&grub_sfs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_sfs_fs.mod = mod; ++ grub_fs_register (&grub_sfs_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI(sfs) + { +- grub_fs_unregister (&grub_sfs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_sfs_fs); + } +diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c +index 8765c633c..3d5ee5af5 100644 +--- a/grub-core/fs/udf.c ++++ b/grub-core/fs/udf.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -1455,12 +1456,16 @@ static struct grub_fs grub_udf_fs = { + + GRUB_MOD_INIT (udf) + { +- grub_udf_fs.mod = mod; +- grub_fs_register (&grub_udf_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_udf_fs.mod = mod; ++ grub_fs_register (&grub_udf_fs); ++ } + my_mod = mod; + } + + GRUB_MOD_FINI (udf) + { +- grub_fs_unregister (&grub_udf_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_udf_fs); + } +diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c +index e82d9356d..8b5adbd48 100644 +--- a/grub-core/fs/ufs.c ++++ b/grub-core/fs/ufs.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -899,8 +900,11 @@ GRUB_MOD_INIT(ufs1) + #endif + #endif + { +- grub_ufs_fs.mod = mod; +- grub_fs_register (&grub_ufs_fs); ++ if (!grub_is_lockdown ()) ++ { ++ grub_ufs_fs.mod = mod; ++ grub_fs_register (&grub_ufs_fs); ++ } + my_mod = mod; + } + +@@ -914,6 +918,7 @@ GRUB_MOD_FINI(ufs1) + #endif + #endif + { +- grub_fs_unregister (&grub_ufs_fs); ++ if (!grub_is_lockdown ()) ++ grub_fs_unregister (&grub_ufs_fs); + } + diff --git a/0333-disk-Use-safe-math-macros-to-prevent-overflows.patch b/0333-disk-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..db3d9371 --- /dev/null +++ b/0333-disk-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,543 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 11 Feb 2025 17:59:04 -0600 +Subject: [PATCH] disk: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/cryptodisk.c | 36 ++++++++++++++++++------ + grub-core/disk/diskfilter.c | 9 ++++-- + grub-core/disk/ieee1275/obdisk.c | 43 ++++++++++++++++++++++++---- + grub-core/disk/ieee1275/ofdisk.c | 60 ++++++++++++++++++++++++++++++++++------ + grub-core/disk/ldm.c | 36 ++++++++++++++++++++---- + grub-core/disk/luks2.c | 7 ++++- + grub-core/disk/memdisk.c | 7 ++++- + grub-core/disk/plainmount.c | 9 ++++-- + 8 files changed, 172 insertions(+), 35 deletions(-) + +diff --git a/grub-core/disk/cryptodisk.c b/grub-core/disk/cryptodisk.c +index 06a42b2d7..872776010 100644 +--- a/grub-core/disk/cryptodisk.c ++++ b/grub-core/disk/cryptodisk.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #ifdef GRUB_UTIL + #include +@@ -1475,7 +1476,7 @@ static char * + luks_script_get (grub_size_t *sz) + { + grub_cryptodisk_t i; +- grub_size_t size = 0; ++ grub_size_t size = 0, mul; + char *ptr, *ret; + + *sz = 0; +@@ -1484,10 +1485,6 @@ luks_script_get (grub_size_t *sz) + if (grub_strcmp (i->modname, "luks") == 0 || + grub_strcmp (i->modname, "luks2") == 0) + { +- size += grub_strlen (i->modname); +- size += sizeof ("_mount"); +- size += grub_strlen (i->uuid); +- size += grub_strlen (i->cipher->cipher->name); + /* + * Add space in the line for (in order) spaces, cipher mode, cipher IV + * mode, sector offset, sector size and the trailing newline. This is +@@ -1495,14 +1492,35 @@ luks_script_get (grub_size_t *sz) + * in an earlier version of this code that are unaccounted for. It is + * left in the calculations in case it is needed. At worst, its short- + * lived wasted space. ++ * ++ * 60 = 5 + 5 + 8 + 20 + 6 + 1 + 15 + */ +- size += 5 + 5 + 8 + 20 + 6 + 1 + 15; ++ if (grub_add (size, grub_strlen (i->modname), &size) || ++ grub_add (size, sizeof ("_mount") + 60, &size) || ++ grub_add (size, grub_strlen (i->uuid), &size) || ++ grub_add (size, grub_strlen (i->cipher->cipher->name), &size) || ++ grub_mul (i->keysize, 2, &mul) || ++ grub_add (size, mul, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } + if (i->essiv_hash) +- size += grub_strlen (i->essiv_hash->name); +- size += i->keysize * 2; ++ { ++ if (grub_add (size, grub_strlen (i->essiv_hash->name), &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } ++ } + } ++ if (grub_add (size, 1, &size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining size of luks script"); ++ return 0; ++ } + +- ret = grub_malloc (size + 1); ++ ret = grub_malloc (size); + if (!ret) + return 0; + +diff --git a/grub-core/disk/diskfilter.c b/grub-core/disk/diskfilter.c +index c35ce8915..fef0b815a 100644 +--- a/grub-core/disk/diskfilter.c ++++ b/grub-core/disk/diskfilter.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #ifdef GRUB_UTIL + #include + #include +@@ -1041,7 +1042,7 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, + { + struct grub_diskfilter_vg *array; + int i; +- grub_size_t j; ++ grub_size_t j, sz; + grub_uint64_t totsize; + struct grub_diskfilter_pv *pv; + grub_err_t err; +@@ -1142,7 +1143,11 @@ grub_diskfilter_make_raid (grub_size_t uuidlen, char *uuid, int nmemb, + } + array->lvs->vg = array; + +- array->lvs->idname = grub_malloc (sizeof ("mduuid/") + 2 * uuidlen); ++ if (grub_mul (uuidlen, 2, &sz) || ++ grub_add (sz, sizeof ("mduuid/"), &sz)) ++ goto fail; ++ ++ array->lvs->idname = grub_malloc (sz); + if (!array->lvs->idname) + goto fail; + +diff --git a/grub-core/disk/ieee1275/obdisk.c b/grub-core/disk/ieee1275/obdisk.c +index cd923b90f..9d4c42665 100644 +--- a/grub-core/disk/ieee1275/obdisk.c ++++ b/grub-core/disk/ieee1275/obdisk.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -128,9 +129,17 @@ count_commas (const char *src) + static char * + decode_grub_devname (const char *name) + { +- char *devpath = grub_malloc (grub_strlen (name) + 1); ++ char *devpath; + char *p, c; ++ grub_size_t sz; + ++ if (grub_add (grub_strlen (name), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device name")); ++ return NULL; ++ } ++ ++ devpath = grub_malloc (sz); + if (devpath == NULL) + return NULL; + +@@ -156,12 +165,20 @@ static char * + encode_grub_devname (const char *path) + { + char *encoding, *optr; ++ grub_size_t sz; + + if (path == NULL) + return NULL; + +- encoding = grub_malloc (sizeof (IEEE1275_DEV) + count_commas (path) + +- grub_strlen (path) + 1); ++ if (grub_add (sizeof (IEEE1275_DEV) + 1, count_commas (path), &sz) || ++ grub_add (sz, grub_strlen (path), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining encoding size")); ++ grub_print_error (); ++ return NULL; ++ } ++ ++ encoding = grub_malloc (sz); + + if (encoding == NULL) + { +@@ -396,6 +413,14 @@ canonicalise_disk (const char *devname) + + real_unit_str_len = grub_strlen (op->name) + sizeof (IEEE1275_DISK_ALIAS) + + grub_strlen (real_unit_address); ++ if (grub_add (grub_strlen (op->name), sizeof (IEEE1275_DISK_ALIAS), &real_unit_str_len) || ++ grub_add (real_unit_str_len, grub_strlen (real_unit_address), &real_unit_str_len)) ++ { ++ grub_free (parent); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of canonical name")); ++ grub_print_error (); ++ return NULL; ++ } + + real_canon = grub_malloc (real_unit_str_len); + +@@ -413,6 +438,7 @@ canonicalise_disk (const char *devname) + static struct disk_dev * + add_canon_disk (const char *cname) + { ++ grub_size_t sz; + struct disk_dev *dev; + + dev = grub_zalloc (sizeof (struct disk_dev)); +@@ -428,13 +454,18 @@ add_canon_disk (const char *cname) + * arguments and allows a client program to open + * the entire (raw) disk. Any disk label is ignored. + */ +- dev->raw_name = grub_malloc (grub_strlen (cname) + sizeof (":nolabel")); ++ if (grub_add (grub_strlen (cname), sizeof (":nolabel"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while appending :nolabel to end of canonical name"); ++ goto failed; ++ } ++ ++ dev->raw_name = grub_malloc (sz); + + if (dev->raw_name == NULL) + goto failed; + +- grub_snprintf (dev->raw_name, grub_strlen (cname) + sizeof (":nolabel"), +- "%s:nolabel", cname); ++ grub_snprintf (dev->raw_name, sz, "%s:nolabel", cname); + } + + /* +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index 57624fde5..6c628635f 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + static char *last_devpath; + static grub_ieee1275_ihandle_t last_ihandle; +@@ -81,6 +82,7 @@ ofdisk_hash_add_real (char *devpath) + struct ofdisk_hash_ent **head = &ofdisk_hash[ofdisk_hash_fn(devpath)]; + const char *iptr; + char *optr; ++ grub_size_t sz; + + p = grub_zalloc (sizeof (*p)); + if (!p) +@@ -88,8 +90,14 @@ ofdisk_hash_add_real (char *devpath) + + p->devpath = devpath; + +- p->grub_devpath = grub_malloc (sizeof ("ieee1275/") +- + 2 * grub_strlen (p->devpath)); ++ if (grub_mul (grub_strlen (p->devpath), 2, &sz) || ++ grub_add (sz, sizeof ("ieee1275/"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device path")); ++ return NULL; ++ } ++ ++ p->grub_devpath = grub_malloc (sz); + + if (!p->grub_devpath) + { +@@ -99,7 +107,13 @@ ofdisk_hash_add_real (char *devpath) + + if (! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_NO_PARTITION_0)) + { +- p->open_path = grub_malloc (grub_strlen (p->devpath) + 3); ++ if (grub_add (grub_strlen (p->devpath), 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of an open path")); ++ return NULL; ++ } ++ ++ p->open_path = grub_malloc (sz); + if (!p->open_path) + { + grub_free (p->grub_devpath); +@@ -225,7 +239,7 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + args; + char *buf, *bufptr; + unsigned i; +- ++ grub_size_t sz; + + RETRY_IEEE1275_OFDISK_OPEN(alias->path, &ihandle) + if (! ihandle) +@@ -246,7 +260,14 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + return; + } + +- buf = grub_malloc (grub_strlen (alias->path) + 32); ++ if (grub_add (grub_strlen (alias->path), 32, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while creating buffer for vscsi"); ++ grub_ieee1275_close (ihandle); ++ return; ++ } ++ ++ buf = grub_malloc (sz); + if (!buf) + return; + bufptr = grub_stpcpy (buf, alias->path); +@@ -290,9 +311,15 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + grub_uint64_t *table; + grub_uint16_t table_size; + grub_ieee1275_ihandle_t ihandle; ++ grub_size_t sz; + +- buf = grub_malloc (grub_strlen (alias->path) + +- sizeof ("/disk@7766554433221100")); ++ if (grub_add (grub_strlen (alias->path), sizeof ("/disk@7766554433221100"), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while creating buffer for sas_ioa"); ++ return; ++ } ++ ++ buf = grub_malloc (sz); + if (!buf) + return; + bufptr = grub_stpcpy (buf, alias->path); +@@ -432,9 +459,17 @@ grub_ofdisk_iterate (grub_disk_dev_iterate_hook_t hook, void *hook_data, + static char * + compute_dev_path (const char *name) + { +- char *devpath = grub_malloc (grub_strlen (name) + 3); ++ char *devpath; + char *p, c; ++ grub_size_t sz; + ++ if (grub_add (grub_strlen (name), 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining size of device path")); ++ return NULL; ++ } ++ ++ devpath = grub_malloc (sz); + if (!devpath) + return NULL; + +@@ -657,6 +692,7 @@ insert_bootpath (void) + char *bootpath; + grub_ssize_t bootpath_size; + char *type; ++ grub_size_t sz; + + if (grub_ieee1275_get_property_length (grub_ieee1275_chosen, "bootpath", + &bootpath_size) +@@ -667,7 +703,13 @@ insert_bootpath (void) + return; + } + +- bootpath = (char *) grub_malloc ((grub_size_t) bootpath_size + 64); ++ if (grub_add (bootpath_size, 64, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining bootpath size")); ++ return; ++ } ++ ++ bootpath = (char *) grub_malloc (sz); + if (! bootpath) + { + grub_print_error (); +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 34bfe6bd1..4101b15d8 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -220,6 +220,7 @@ make_vg (grub_disk_t disk, + struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_ldm_vblk)]; + unsigned i; ++ grub_size_t sz; + err = grub_disk_read (disk, cursec, 0, + sizeof(vblk), &vblk); + if (err) +@@ -251,7 +252,13 @@ make_vg (grub_disk_t disk, + grub_free (pv); + goto fail2; + } +- pv->internal_id = grub_malloc (ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (pv); ++ goto fail2; ++ } ++ ++ pv->internal_id = grub_malloc (sz); + if (!pv->internal_id) + { + grub_free (pv); +@@ -276,7 +283,15 @@ make_vg (grub_disk_t disk, + goto fail2; + } + pv->id.uuidlen = *ptr; +- pv->id.uuid = grub_malloc (pv->id.uuidlen + 1); ++ ++ if (grub_add (pv->id.uuidlen, 1, &sz)) ++ { ++ grub_free (pv->internal_id); ++ grub_free (pv); ++ goto fail2; ++ } ++ ++ pv->id.uuid = grub_malloc (sz); + grub_memcpy (pv->id.uuid, ptr + 1, pv->id.uuidlen); + pv->id.uuid[pv->id.uuidlen] = 0; + +@@ -343,7 +358,13 @@ make_vg (grub_disk_t disk, + grub_free (lv); + goto fail2; + } +- lv->internal_id = grub_malloc ((grub_size_t) ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (lv->segments); ++ grub_free (lv); ++ goto fail2; ++ } ++ lv->internal_id = grub_malloc (sz); + if (!lv->internal_id) + { + grub_free (lv); +@@ -455,6 +476,7 @@ make_vg (grub_disk_t disk, + struct grub_ldm_vblk vblk[GRUB_DISK_SECTOR_SIZE + / sizeof (struct grub_ldm_vblk)]; + unsigned i; ++ grub_size_t sz; + err = grub_disk_read (disk, cursec, 0, + sizeof(vblk), &vblk); + if (err) +@@ -490,7 +512,12 @@ make_vg (grub_disk_t disk, + grub_free (comp); + goto fail2; + } +- comp->internal_id = grub_malloc ((grub_size_t) ptr[0] + 2); ++ if (grub_add (ptr[0], 2, &sz)) ++ { ++ grub_free (comp); ++ goto fail2; ++ } ++ comp->internal_id = grub_malloc (sz); + if (!comp->internal_id) + { + grub_free (comp); +@@ -640,7 +667,6 @@ make_vg (grub_disk_t disk, + if (lv->segments->node_alloc == lv->segments->node_count) + { + void *t; +- grub_size_t sz; + + if (grub_mul (lv->segments->node_alloc, 2, &lv->segments->node_alloc) || + grub_mul (lv->segments->node_alloc, sizeof (*lv->segments->nodes), &sz)) +diff --git a/grub-core/disk/luks2.c b/grub-core/disk/luks2.c +index d5106402f..8036d76ff 100644 +--- a/grub-core/disk/luks2.c ++++ b/grub-core/disk/luks2.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -569,6 +570,7 @@ luks2_recover_key (grub_disk_t source, + gcry_err_code_t gcry_ret; + grub_json_t *json = NULL, keyslots; + grub_err_t ret; ++ grub_size_t sz; + + if (cargs->key_data == NULL || cargs->key_len == 0) + return grub_error (GRUB_ERR_BAD_ARGUMENT, "no key data"); +@@ -577,7 +579,10 @@ luks2_recover_key (grub_disk_t source, + if (ret) + return ret; + +- json_header = grub_zalloc (grub_be_to_cpu64 (header.hdr_size) - sizeof (header)); ++ if (grub_sub (grub_be_to_cpu64 (header.hdr_size), sizeof (header), &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while calculating json header size"); ++ ++ json_header = grub_zalloc (sz); + if (!json_header) + return GRUB_ERR_OUT_OF_MEMORY; + +diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c +index 613779cf3..36de3bfab 100644 +--- a/grub-core/disk/memdisk.c ++++ b/grub-core/disk/memdisk.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -96,7 +97,11 @@ GRUB_MOD_INIT(memdisk) + + grub_dprintf ("memdisk", "Found memdisk image at %p\n", memdisk_orig_addr); + +- memdisk_size = header->size - sizeof (struct grub_module_header); ++ if (grub_sub (header->size, sizeof (struct grub_module_header), &memdisk_size)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while obtaining memdisk size"); ++ return; ++ } + memdisk_addr = grub_malloc (memdisk_size); + + grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n"); +diff --git a/grub-core/disk/plainmount.c b/grub-core/disk/plainmount.c +index 47e64805f..21ec4072c 100644 +--- a/grub-core/disk/plainmount.c ++++ b/grub-core/disk/plainmount.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -126,7 +127,7 @@ plainmount_configure_password (grub_cryptodisk_t dev, const char *hash, + grub_uint8_t *derived_hash, *dh; + char *p; + unsigned int round, i, len, size; +- grub_size_t alloc_size; ++ grub_size_t alloc_size, sz; + grub_err_t err = GRUB_ERR_NONE; + + /* Support none (plain) hash */ +@@ -145,7 +146,11 @@ plainmount_configure_password (grub_cryptodisk_t dev, const char *hash, + * Allocate buffer for the password and for an added prefix character + * for each hash round ('alloc_size' may not be a multiple of 'len'). + */ +- p = grub_zalloc (alloc_size + (alloc_size / len) + 1); ++ if (grub_add (alloc_size, (alloc_size / len), &sz) || ++ grub_add (sz, 1, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while allocating size of password buffer")); ++ ++ p = grub_zalloc (sz); + derived_hash = grub_zalloc (GRUB_CRYPTODISK_MAX_KEYLEN * 2); + if (p == NULL || derived_hash == NULL) + { diff --git a/0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch b/0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch new file mode 100644 index 00000000..15a916f2 --- /dev/null +++ b/0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 12 Feb 2025 10:26:44 -0600 +Subject: [PATCH] disk: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/lvm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index 794248540..a395b200d 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -671,8 +671,7 @@ grub_lvm_detect (grub_disk_t disk, + goto lvs_segment_fail; + } + +- seg->nodes = grub_zalloc (sizeof (seg->nodes[0]) +- * seg->node_count); ++ seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); + + p = grub_strstr (p, "mirrors = ["); + if (p == NULL) +@@ -760,8 +759,7 @@ grub_lvm_detect (grub_disk_t disk, + } + } + +- seg->nodes = grub_zalloc (sizeof (seg->nodes[0]) +- * seg->node_count); ++ seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); + + p = grub_strstr (p, "raids = ["); + if (p == NULL) diff --git a/0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch b/0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch new file mode 100644 index 00000000..efb631e9 --- /dev/null +++ b/0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch @@ -0,0 +1,152 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:11 +0000 +Subject: [PATCH] disk: Check if returned pointer for allocated memory is NULL + +When using grub_malloc(), grub_zalloc() or grub_calloc(), these functions can +fail if we are out of memory. After allocating memory we should check if these +functions returned NULL and handle this error if they did. + +On the occasion make a NULL check in ATA code more obvious. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/ata.c | 4 ++-- + grub-core/disk/ieee1275/obdisk.c | 6 ++++++ + grub-core/disk/ldm.c | 6 ++++++ + grub-core/disk/lvm.c | 14 ++++++++++++++ + grub-core/disk/memdisk.c | 2 ++ + 5 files changed, 30 insertions(+), 2 deletions(-) + +diff --git a/grub-core/disk/ata.c b/grub-core/disk/ata.c +index 7b6ac7bfc..a2433e29e 100644 +--- a/grub-core/disk/ata.c ++++ b/grub-core/disk/ata.c +@@ -112,10 +112,10 @@ grub_ata_identify (struct grub_ata *dev) + return grub_atapi_identify (dev); + + info64 = grub_malloc (GRUB_DISK_SECTOR_SIZE); ++ if (info64 == NULL) ++ return grub_errno; + info32 = (grub_uint32_t *) info64; + info16 = (grub_uint16_t *) info64; +- if (! info16) +- return grub_errno; + + grub_memset (&parms, 0, sizeof (parms)); + parms.buffer = info16; +diff --git a/grub-core/disk/ieee1275/obdisk.c b/grub-core/disk/ieee1275/obdisk.c +index 9d4c42665..fcc39e0a2 100644 +--- a/grub-core/disk/ieee1275/obdisk.c ++++ b/grub-core/disk/ieee1275/obdisk.c +@@ -423,6 +423,12 @@ canonicalise_disk (const char *devname) + } + + real_canon = grub_malloc (real_unit_str_len); ++ if (real_canon == NULL) ++ { ++ grub_free (parent); ++ grub_print_error (); ++ return NULL; ++ } + + grub_snprintf (real_canon, real_unit_str_len, "%s/disk@%s", + op->name, real_unit_address); +diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c +index 4101b15d8..048e29cd0 100644 +--- a/grub-core/disk/ldm.c ++++ b/grub-core/disk/ldm.c +@@ -292,6 +292,12 @@ make_vg (grub_disk_t disk, + } + + pv->id.uuid = grub_malloc (sz); ++ if (pv->id.uuid == NULL) ++ { ++ grub_free (pv->internal_id); ++ grub_free (pv); ++ goto fail2; ++ } + grub_memcpy (pv->id.uuid, ptr + 1, pv->id.uuidlen); + pv->id.uuid[pv->id.uuidlen] = 0; + +diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c +index a395b200d..b2dff76d1 100644 +--- a/grub-core/disk/lvm.c ++++ b/grub-core/disk/lvm.c +@@ -370,6 +370,8 @@ grub_lvm_detect (grub_disk_t disk, + break; + + pv = grub_zalloc (sizeof (*pv)); ++ if (pv == NULL) ++ goto fail4; + q = p; + while (*q != ' ' && q < mda_end) + q++; +@@ -379,6 +381,8 @@ grub_lvm_detect (grub_disk_t disk, + + s = q - p; + pv->name = grub_malloc (s + 1); ++ if (pv->name == NULL) ++ goto pvs_fail_noname; + grub_memcpy (pv->name, p, s); + pv->name[s] = '\0'; + +@@ -451,6 +455,8 @@ grub_lvm_detect (grub_disk_t disk, + break; + + lv = grub_zalloc (sizeof (*lv)); ++ if (lv == NULL) ++ goto fail4; + + q = p; + while (*q != ' ' && q < mda_end) +@@ -545,6 +551,8 @@ grub_lvm_detect (grub_disk_t disk, + goto lvs_fail; + } + lv->segments = grub_calloc (lv->segment_count, sizeof (*seg)); ++ if (lv->segments == NULL) ++ goto lvs_fail; + seg = lv->segments; + + for (i = 0; i < lv->segment_count; i++) +@@ -612,6 +620,8 @@ grub_lvm_detect (grub_disk_t disk, + + seg->nodes = grub_calloc (seg->node_count, + sizeof (*stripe)); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + stripe = seg->nodes; + + p = grub_strstr (p, "stripes = ["); +@@ -672,6 +682,8 @@ grub_lvm_detect (grub_disk_t disk, + } + + seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + + p = grub_strstr (p, "mirrors = ["); + if (p == NULL) +@@ -760,6 +772,8 @@ grub_lvm_detect (grub_disk_t disk, + } + + seg->nodes = grub_calloc (seg->node_count, sizeof (seg->nodes[0])); ++ if (seg->nodes == NULL) ++ goto lvs_segment_fail; + + p = grub_strstr (p, "raids = ["); + if (p == NULL) +diff --git a/grub-core/disk/memdisk.c b/grub-core/disk/memdisk.c +index 36de3bfab..2d7afaea3 100644 +--- a/grub-core/disk/memdisk.c ++++ b/grub-core/disk/memdisk.c +@@ -103,6 +103,8 @@ GRUB_MOD_INIT(memdisk) + return; + } + memdisk_addr = grub_malloc (memdisk_size); ++ if (memdisk_addr == NULL) ++ return; + + grub_dprintf ("memdisk", "Copying memdisk image to dynamic memory\n"); + grub_memmove (memdisk_addr, memdisk_orig_addr, memdisk_size); diff --git a/0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch b/0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch new file mode 100644 index 00000000..2836631a --- /dev/null +++ b/0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 02:55:12 +0000 +Subject: [PATCH] disk/ieee1275/ofdisk: Call grub_ieee1275_close() when + grub_malloc() fails + +In the dev_iterate() function a handle is opened but isn't closed when +grub_malloc() returns NULL. We should fix this by closing it on error. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/disk/ieee1275/ofdisk.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/grub-core/disk/ieee1275/ofdisk.c b/grub-core/disk/ieee1275/ofdisk.c +index 6c628635f..71237b256 100644 +--- a/grub-core/disk/ieee1275/ofdisk.c ++++ b/grub-core/disk/ieee1275/ofdisk.c +@@ -269,7 +269,10 @@ dev_iterate (const struct grub_ieee1275_devalias *alias) + + buf = grub_malloc (sz); + if (!buf) +- return; ++ { ++ grub_ieee1275_close (ihandle); ++ return; ++ } + bufptr = grub_stpcpy (buf, alias->path); + + for (i = 0; i < args.nentries; i++) diff --git a/0337-fs-Use-safe-math-macros-to-prevent-overflows.patch b/0337-fs-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..43eb12c7 --- /dev/null +++ b/0337-fs-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,353 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 12 Feb 2025 10:33:31 -0600 +Subject: [PATCH] fs: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/archelp.c | 9 ++++++++- + grub-core/fs/btrfs.c | 34 ++++++++++++++++++++++++++++------ + grub-core/fs/cpio_common.c | 16 ++++++++++++++-- + grub-core/fs/f2fs.c | 17 +++++++++++++++-- + grub-core/fs/ntfscomp.c | 9 ++++++++- + grub-core/fs/squash4.c | 12 +++++++++--- + grub-core/fs/xfs.c | 17 +++++++++++++++-- + 7 files changed, 97 insertions(+), 17 deletions(-) + +diff --git a/grub-core/fs/archelp.c b/grub-core/fs/archelp.c +index c1dcc6285..0816b28de 100644 +--- a/grub-core/fs/archelp.c ++++ b/grub-core/fs/archelp.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -68,6 +69,7 @@ handle_symlink (struct grub_archelp_data *data, + char *rest; + char *linktarget; + grub_size_t linktarget_len; ++ grub_size_t sz; + + *restart = 0; + +@@ -98,7 +100,12 @@ handle_symlink (struct grub_archelp_data *data, + if (linktarget[0] == '\0') + return GRUB_ERR_NONE; + linktarget_len = grub_strlen (linktarget); +- target = grub_malloc (linktarget_len + grub_strlen (*name) + 2); ++ ++ if (grub_add (linktarget_len, grub_strlen (*name), &sz) || ++ grub_add (sz, 2, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("link target length overflow")); ++ ++ target = grub_malloc (sz); + if (!target) + return grub_errno; + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 6593f5175..3e4924b65 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -2031,6 +2031,7 @@ find_path (struct grub_btrfs_data *data, + char *origpath = NULL; + unsigned symlinks_max = 32; + const char *relpath = grub_env_get ("btrfs_relative_path"); ++ grub_size_t sz; + + follow_default = 0; + origpath = grub_strdup (path); +@@ -2157,9 +2158,15 @@ find_path (struct grub_btrfs_data *data, + struct grub_btrfs_dir_item *cdirel; + if (elemsize > allocated) + { +- allocated = 2 * elemsize; ++ if (grub_mul (2, elemsize, &allocated) || ++ grub_add (allocated, 1, &sz)) ++ { ++ grub_free (path_alloc); ++ grub_free (origpath); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory item size overflow")); ++ } + grub_free (direl); +- direl = grub_malloc (allocated + 1); ++ direl = grub_malloc (sz); + if (!direl) + { + grub_free (path_alloc); +@@ -2223,8 +2230,16 @@ find_path (struct grub_btrfs_data *data, + grub_free (origpath); + return err; + } +- tmp = grub_malloc (grub_le_to_cpu64 (inode.size) +- + grub_strlen (path) + 1); ++ ++ if (grub_add (grub_le_to_cpu64 (inode.size), grub_strlen (path), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_free (direl); ++ grub_free (path_alloc); ++ grub_free (origpath); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("buffer size overflow")); ++ } ++ tmp = grub_malloc (sz); + if (!tmp) + { + grub_free (direl); +@@ -2371,6 +2386,7 @@ grub_btrfs_dir (grub_device_t device, const char *path, + grub_uint8_t type; + grub_size_t est_size = 0; + char *new_path = NULL; ++ grub_size_t sz; + + if (!data) + return grub_errno; +@@ -2420,9 +2436,15 @@ grub_btrfs_dir (grub_device_t device, const char *path, + } + if (elemsize > allocated) + { +- allocated = 2 * elemsize; ++ if (grub_mul (2, elemsize, &allocated) || ++ grub_add (allocated, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory element size overflow")); ++ r = -grub_errno; ++ break; ++ } + grub_free (direl); +- direl = grub_malloc (allocated + 1); ++ direl = grub_malloc (sz); + if (!direl) + { + r = -grub_errno; +diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c +index 5d41b6fdb..6ba58b354 100644 +--- a/grub-core/fs/cpio_common.c ++++ b/grub-core/fs/cpio_common.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -48,6 +49,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + struct head hd; + grub_size_t namesize; + grub_uint32_t modeval; ++ grub_size_t sz; + + data->hofs = data->next_hofs; + +@@ -76,7 +78,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + + *mode = modeval; + +- *name = grub_malloc (namesize + 1); ++ if (grub_add (namesize, 1, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("file name size overflow")); ++ ++ *name = grub_malloc (sz); + if (*name == NULL) + return grub_errno; + +@@ -110,10 +115,17 @@ grub_cpio_get_link_target (struct grub_archelp_data *data) + { + char *ret; + grub_err_t err; ++ grub_size_t sz; + + if (data->size == 0) + return grub_strdup (""); +- ret = grub_malloc (data->size + 1); ++ ++ if (grub_add (data->size, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("target data size overflow")); ++ return NULL; ++ } ++ ret = grub_malloc (sz); + if (!ret) + return NULL; + +diff --git a/grub-core/fs/f2fs.c b/grub-core/fs/f2fs.c +index f6d6beaa5..72b4aa1e6 100644 +--- a/grub-core/fs/f2fs.c ++++ b/grub-core/fs/f2fs.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -958,6 +959,7 @@ grub_f2fs_read_symlink (grub_fshelp_node_t node) + char *symlink; + struct grub_fshelp_node *diro = node; + grub_uint64_t filesize; ++ grub_size_t sz; + + if (!diro->inode_read) + { +@@ -968,7 +970,12 @@ grub_f2fs_read_symlink (grub_fshelp_node_t node) + + filesize = grub_f2fs_file_size(&diro->inode.i); + +- symlink = grub_malloc (filesize + 1); ++ if (grub_add (filesize, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink size overflow")); ++ return 0; ++ } ++ symlink = grub_malloc (sz); + if (!symlink) + return 0; + +@@ -997,6 +1004,7 @@ grub_f2fs_check_dentries (struct grub_f2fs_dir_iter_ctx *ctx) + enum FILE_TYPE ftype; + int name_len; + int ret; ++ int sz; + + if (grub_f2fs_test_bit_le (i, ctx->bitmap) == 0) + { +@@ -1010,7 +1018,12 @@ grub_f2fs_check_dentries (struct grub_f2fs_dir_iter_ctx *ctx) + if (name_len >= F2FS_NAME_LEN) + return 0; + +- filename = grub_malloc (name_len + 1); ++ if (grub_add (name_len, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory entry name length overflow")); ++ return 0; ++ } ++ filename = grub_malloc (sz); + if (!filename) + return 0; + +diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c +index a009f2c2d..f168a318e 100644 +--- a/grub-core/fs/ntfscomp.c ++++ b/grub-core/fs/ntfscomp.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -310,6 +311,7 @@ ntfscomp (grub_uint8_t *dest, grub_disk_addr_t ofs, + { + grub_err_t ret; + grub_disk_addr_t vcn; ++ int log_sz; + + if (ctx->attr->sbuf) + { +@@ -349,7 +351,12 @@ ntfscomp (grub_uint8_t *dest, grub_disk_addr_t ofs, + } + + ctx->comp.comp_head = ctx->comp.comp_tail = 0; +- ctx->comp.cbuf = grub_malloc (1 << (ctx->comp.log_spc + GRUB_NTFS_BLK_SHR)); ++ if (grub_add (ctx->comp.log_spc, GRUB_NTFS_BLK_SHR, &log_sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("compression buffer size overflow")); ++ return 0; ++ } ++ ctx->comp.cbuf = grub_malloc (1 << log_sz); + if (!ctx->comp.cbuf) + return 0; + +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index 6e9d63874..f91ff3bfa 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -460,11 +460,11 @@ grub_squash_read_symlink (grub_fshelp_node_t node) + { + char *ret; + grub_err_t err; +- grub_size_t sz; ++ grub_uint32_t sz; + + if (grub_add (grub_le_to_cpu32 (node->ino.symlink.namelen), 1, &sz)) + { +- grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected")); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink name length overflow")); + return NULL; + } + +@@ -580,6 +580,7 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + struct grub_squash_dirent di; + struct grub_squash_inode ino; + grub_size_t sz; ++ grub_uint16_t nlen; + + err = read_chunk (dir->data, &di, sizeof (di), + grub_le_to_cpu64 (dir->data->sb.diroffset) +@@ -595,7 +596,12 @@ grub_squash_iterate_dir (grub_fshelp_node_t dir, + if (err) + return 0; + +- buf = grub_malloc (grub_le_to_cpu16 (di.namelen) + 2); ++ if (grub_add (grub_le_to_cpu16 (di.namelen), 2, &nlen)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ return 0; ++ } ++ buf = grub_malloc (nlen); + if (!buf) + return 0; + err = read_chunk (dir->data, buf, +diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c +index 6c952aef1..c60db7361 100644 +--- a/grub-core/fs/xfs.c ++++ b/grub-core/fs/xfs.c +@@ -718,6 +718,7 @@ static char * + grub_xfs_read_symlink (grub_fshelp_node_t node) + { + grub_ssize_t size = grub_be_to_cpu64 (node->inode.size); ++ grub_size_t sz; + + if (size < 0) + { +@@ -739,7 +740,12 @@ grub_xfs_read_symlink (grub_fshelp_node_t node) + if (node->data->hascrc) + off = 56; + +- symlink = grub_malloc (size + 1); ++ if (grub_add (size, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("symlink size overflow")); ++ return 0; ++ } ++ symlink = grub_malloc (sz); + if (!symlink) + return 0; + +@@ -789,8 +795,15 @@ static int iterate_dir_call_hook (grub_uint64_t ino, const char *filename, + { + struct grub_fshelp_node *fdiro; + grub_err_t err; ++ grub_size_t sz; + +- fdiro = grub_malloc (grub_xfs_fshelp_size(ctx->diro->data) + 1); ++ if (grub_add (grub_xfs_fshelp_size(ctx->diro->data), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("directory data size overflow")); ++ grub_print_error (); ++ return 0; ++ } ++ fdiro = grub_malloc (sz); + if (!fdiro) + { + grub_print_error (); diff --git a/0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch b/0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch new file mode 100644 index 00000000..936c2f87 --- /dev/null +++ b/0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch @@ -0,0 +1,82 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:37 +0000 +Subject: [PATCH] fs: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +The HFS+ and squash4 security vulnerabilities were reported by +Jonathan Bar Or . + +Fixes: CVE-2025-0678 +Fixes: CVE-2025-1125 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/btrfs.c | 4 ++-- + grub-core/fs/hfspluscomp.c | 9 +++++++-- + grub-core/fs/squash4.c | 8 ++++---- + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c +index 3e4924b65..3228e1788 100644 +--- a/grub-core/fs/btrfs.c ++++ b/grub-core/fs/btrfs.c +@@ -1409,8 +1409,8 @@ grub_btrfs_mount (grub_device_t dev) + } + + data->n_devices_allocated = 16; +- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0]) +- * data->n_devices_allocated); ++ data->devices_attached = grub_calloc (data->n_devices_allocated, ++ sizeof (data->devices_attached[0])); + if (!data->devices_attached) + { + grub_free (data); +diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c +index 48ae438d8..a80954ee6 100644 +--- a/grub-core/fs/hfspluscomp.c ++++ b/grub-core/fs/hfspluscomp.c +@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node) + return 0; + } + node->compress_index_size = grub_le_to_cpu32 (index_size); +- node->compress_index = grub_malloc (node->compress_index_size +- * sizeof (node->compress_index[0])); ++ node->compress_index = grub_calloc (node->compress_index_size, ++ sizeof (node->compress_index[0])); + if (!node->compress_index) + { + node->compressed = 0; + grub_free (attr_node); + return grub_errno; + } ++ ++ /* ++ * The node->compress_index_size * sizeof (node->compress_index[0]) is safe here ++ * due to relevant checks done in grub_calloc() above. ++ */ + if (grub_hfsplus_read_file (node, 0, 0, + 0x104 + sizeof (index_size), + node->compress_index_size +diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c +index f91ff3bfa..cf2bca822 100644 +--- a/grub-core/fs/squash4.c ++++ b/grub-core/fs/squash4.c +@@ -822,10 +822,10 @@ direct_read (struct grub_squash_data *data, + break; + } + total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz); +- ino->block_sizes = grub_malloc (total_blocks +- * sizeof (ino->block_sizes[0])); +- ino->cumulated_block_sizes = grub_malloc (total_blocks +- * sizeof (ino->cumulated_block_sizes[0])); ++ ino->block_sizes = grub_calloc (total_blocks, ++ sizeof (ino->block_sizes[0])); ++ ino->cumulated_block_sizes = grub_calloc (total_blocks, ++ sizeof (ino->cumulated_block_sizes[0])); + if (!ino->block_sizes || !ino->cumulated_block_sizes) + { + grub_free (ino->block_sizes); diff --git a/0339-fs-Prevent-overflows-when-assigning-returned-values-.patch b/0339-fs-Prevent-overflows-when-assigning-returned-values-.patch new file mode 100644 index 00000000..97f8098f --- /dev/null +++ b/0339-fs-Prevent-overflows-when-assigning-returned-values-.patch @@ -0,0 +1,105 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:38 +0000 +Subject: [PATCH] fs: Prevent overflows when assigning returned values from + read_number() + +The direct assignment of the unsigned long long value returned by +read_number() can potentially lead to an overflow on a 32-bit systems. +The fix replaces the direct assignments with calls to grub_cast() +which detects the overflows and safely assigns the values if no +overflow is detected. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/cpio_common.c | 18 ++++++++++++++---- + grub-core/fs/tar.c | 23 ++++++++++++++++------- + 2 files changed, 30 insertions(+), 11 deletions(-) + +diff --git a/grub-core/fs/cpio_common.c b/grub-core/fs/cpio_common.c +index 6ba58b354..45ac119a8 100644 +--- a/grub-core/fs/cpio_common.c ++++ b/grub-core/fs/cpio_common.c +@@ -62,11 +62,21 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + #endif + ) + return grub_error (GRUB_ERR_BAD_FS, "invalid cpio archive"); +- data->size = read_number (hd.filesize, ARRAY_SIZE (hd.filesize)); ++ ++ if (grub_cast (read_number (hd.filesize, ARRAY_SIZE (hd.filesize)), &data->size)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("data size overflow")); ++ + if (mtime) +- *mtime = read_number (hd.mtime, ARRAY_SIZE (hd.mtime)); +- modeval = read_number (hd.mode, ARRAY_SIZE (hd.mode)); +- namesize = read_number (hd.namesize, ARRAY_SIZE (hd.namesize)); ++ { ++ if (grub_cast (read_number (hd.mtime, ARRAY_SIZE (hd.mtime)), mtime)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mtime overflow")); ++ } ++ ++ if (grub_cast (read_number (hd.mode, ARRAY_SIZE (hd.mode)), &modeval)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mode overflow")); ++ ++ if (grub_cast (read_number (hd.namesize, ARRAY_SIZE (hd.namesize)), &namesize)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("namesize overflow")); + + /* Don't allow negative numbers. */ + if (namesize >= 0x80000000) +diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c +index fd2ec1f74..1eaa5349f 100644 +--- a/grub-core/fs/tar.c ++++ b/grub-core/fs/tar.c +@@ -99,9 +99,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + if (hd.typeflag == 'L') + { + grub_err_t err; +- grub_size_t namesize = read_number (hd.size, sizeof (hd.size)); ++ grub_size_t namesize; + +- if (grub_add (namesize, 1, &sz)) ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &namesize) || ++ grub_add (namesize, 1, &sz)) + return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow")); + + *name = grub_malloc (sz); +@@ -123,9 +124,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + if (hd.typeflag == 'K') + { + grub_err_t err; +- grub_size_t linksize = read_number (hd.size, sizeof (hd.size)); ++ grub_size_t linksize; + +- if (grub_add (linksize, 1, &sz)) ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &linksize) || ++ grub_add (linksize, 1, &sz)) + return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow")); + + if (data->linkname_alloc < sz) +@@ -174,15 +176,22 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name, + (*name)[extra_size + sizeof (hd.name)] = 0; + } + +- data->size = read_number (hd.size, sizeof (hd.size)); ++ if (grub_cast (read_number (hd.size, sizeof (hd.size)), &data->size)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("data size overflow")); ++ + data->dofs = data->hofs + GRUB_DISK_SECTOR_SIZE; + data->next_hofs = data->dofs + ((data->size + GRUB_DISK_SECTOR_SIZE - 1) & + ~(GRUB_DISK_SECTOR_SIZE - 1)); + if (mtime) +- *mtime = read_number (hd.mtime, sizeof (hd.mtime)); ++ { ++ if (grub_cast (read_number (hd.mtime, sizeof (hd.mtime)), mtime)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mtime overflow")); ++ } + if (mode) + { +- *mode = read_number (hd.mode, sizeof (hd.mode)); ++ if (grub_cast (read_number (hd.mode, sizeof (hd.mode)), mode)) ++ return grub_error (GRUB_ERR_BAD_FS, N_("mode overflow")); ++ + switch (hd.typeflag) + { + /* Hardlink. */ diff --git a/0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch b/0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..427877de --- /dev/null +++ b/0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,138 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:02 +0000 +Subject: [PATCH] fs/zfs: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 50 ++++++++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 44 insertions(+), 6 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index a497b1869..2f303d655 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -2387,6 +2387,7 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + zap_dnode->endian) << DNODE_SHIFT); + grub_err_t err; + grub_zfs_endian_t endian; ++ grub_size_t sz; + + if (zap_verify (zap, zap_dnode->endian)) + return 0; +@@ -2448,8 +2449,14 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + if (le->le_type != ZAP_CHUNK_ENTRY) + continue; + +- buf = grub_malloc (grub_zfs_to_cpu16 (le->le_name_length, endian) +- * name_elem_length + 1); ++ if (grub_mul (grub_zfs_to_cpu16 (le->le_name_length, endian), name_elem_length, &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("buffer size overflow")); ++ grub_free (l); ++ return grub_errno; ++ } ++ buf = grub_malloc (sz); + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_name_chunk, + endian), +@@ -2872,6 +2879,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + && ((grub_zfs_to_cpu64(((znode_phys_t *) DN_BONUS (&dnode_path->dn.dn))->zp_mode, dnode_path->dn.endian) >> 12) & 0xf) == 0xa) + { + char *sym_value; ++ grub_size_t sz; + grub_size_t sym_sz; + int free_symval = 0; + char *oldpath = path, *oldpathbuf = path_buf; +@@ -2923,7 +2931,18 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + break; + free_symval = 1; + } +- path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); ++ ++ if (grub_add (sym_sz, grub_strlen (oldpath), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("path buffer size overflow")); ++ grub_free (oldpathbuf); ++ if (free_symval) ++ grub_free (sym_value); ++ err = grub_errno; ++ break; ++ } ++ path = path_buf = grub_malloc (sz); + if (!path_buf) + { + grub_free (oldpathbuf); +@@ -2960,6 +2979,7 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + { + void *sahdrp; + int hdrsize; ++ grub_size_t sz; + + if (dnode_path->dn.dn.dn_bonuslen != 0) + { +@@ -2993,7 +3013,15 @@ dnode_get_path (struct subvolume *subvol, const char *path_in, dnode_end_t *dn, + + SA_SIZE_OFFSET), + dnode_path->dn.endian); + char *oldpath = path, *oldpathbuf = path_buf; +- path = path_buf = grub_malloc (sym_sz + grub_strlen (oldpath) + 1); ++ if (grub_add (sym_sz, grub_strlen (oldpath), &sz) || ++ grub_add (sz, 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("path buffer size overflow")); ++ grub_free (oldpathbuf); ++ err = grub_errno; ++ break; ++ } ++ path = path_buf = grub_malloc (sz); + if (!path_buf) + { + grub_free (oldpathbuf); +@@ -3568,6 +3596,7 @@ grub_zfs_nvlist_lookup_nvlist_array (const char *nvlist, const char *name, + unsigned i; + grub_size_t nelm; + int elemsize = 0; ++ int sz; + + found = nvlist_find_value (nvlist, name, DATA_TYPE_NVLIST_ARRAY, &nvpair, + &size, &nelm); +@@ -3602,7 +3631,12 @@ grub_zfs_nvlist_lookup_nvlist_array (const char *nvlist, const char *name, + return 0; + } + +- ret = grub_zalloc (elemsize + sizeof (grub_uint32_t)); ++ if (grub_add (elemsize, sizeof (grub_uint32_t), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("elemsize overflow")); ++ return 0; ++ } ++ ret = grub_zalloc (sz); + if (!ret) + return 0; + grub_memcpy (ret, nvlist, sizeof (grub_uint32_t)); +@@ -4193,6 +4227,7 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + struct grub_dirhook_info info; + char *name2; + int ret; ++ grub_size_t sz; + + dnode_end_t mdn; + +@@ -4213,7 +4248,10 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + return 0; + } + +- name2 = grub_malloc (grub_strlen (name) + 2); ++ if (grub_add (grub_strlen (name), 2, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ ++ name2 = grub_malloc (sz); + name2[0] = '@'; + grub_memcpy (name2 + 1, name, grub_strlen (name) + 1); + ret = ctx->hook (name2, &info, ctx->hook_data); diff --git a/0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch b/0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch new file mode 100644 index 00000000..64c0e286 --- /dev/null +++ b/0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch @@ -0,0 +1,40 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:03 +0000 +Subject: [PATCH] fs/zfs: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 2f303d655..9ab7bf319 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -723,8 +723,8 @@ fill_vdev_info_real (struct grub_zfs_data *data, + { + fill->n_children = nelm; + +- fill->children = grub_zalloc (fill->n_children +- * sizeof (fill->children[0])); ++ fill->children = grub_calloc (fill->n_children, ++ sizeof (fill->children[0])); + } + + for (i = 0; i < nelm; i++) +@@ -3712,8 +3712,8 @@ zfs_mount (grub_device_t dev) + #endif + + data->n_devices_allocated = 16; +- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0]) +- * data->n_devices_allocated); ++ data->devices_attached = grub_calloc (data->n_devices_allocated, ++ sizeof (data->devices_attached[0])); + data->n_devices_attached = 0; + err = scan_disk (dev, data, 1, &inserted); + if (err) diff --git a/0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch b/0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch new file mode 100644 index 00000000..7870587f --- /dev/null +++ b/0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch @@ -0,0 +1,88 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:01 +0000 +Subject: [PATCH] fs/zfs: Check if returned pointer for allocated memory is + NULL + +When using grub_malloc() or grub_zalloc(), these functions can fail if +we are out of memory. After allocating memory we should check if these +functions returned NULL and handle this error if they did. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 9ab7bf319..6e6d1c921 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -614,6 +614,8 @@ zfs_fetch_nvlist (struct grub_zfs_device_desc *diskdesc, char **nvlist) + return grub_error (GRUB_ERR_BUG, "member drive unknown"); + + *nvlist = grub_malloc (VDEV_PHYS_SIZE); ++ if (!*nvlist) ++ return grub_errno; + + /* Read in the vdev name-value pair list (112K). */ + err = grub_disk_read (diskdesc->dev->disk, diskdesc->vdev_phys_sector, 0, +@@ -725,6 +727,11 @@ fill_vdev_info_real (struct grub_zfs_data *data, + + fill->children = grub_calloc (fill->n_children, + sizeof (fill->children[0])); ++ if (!fill->children) ++ { ++ grub_free (type); ++ return grub_errno; ++ } + } + + for (i = 0; i < nelm; i++) +@@ -2457,6 +2464,11 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + return grub_errno; + } + buf = grub_malloc (sz); ++ if (!buf) ++ { ++ grub_free (l); ++ return grub_errno; ++ } + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_name_chunk, + endian), +@@ -2472,6 +2484,12 @@ fzap_iterate (dnode_end_t * zap_dnode, zap_phys_t * zap, + val_length = ((int) le->le_value_length + * (int) le->le_int_size); + val = grub_malloc (grub_zfs_to_cpu16 (val_length, endian)); ++ if (!val) ++ { ++ grub_free (l); ++ grub_free (buf); ++ return grub_errno; ++ } + if (zap_leaf_array_get (l, endian, blksft, + grub_zfs_to_cpu16 (le->le_value_chunk, + endian), +@@ -3714,6 +3732,11 @@ zfs_mount (grub_device_t dev) + data->n_devices_allocated = 16; + data->devices_attached = grub_calloc (data->n_devices_allocated, + sizeof (data->devices_attached[0])); ++ if (!data->devices_attached) ++ { ++ grub_free (data); ++ return NULL; ++ } + data->n_devices_attached = 0; + err = scan_disk (dev, data, 1, &inserted); + if (err) +@@ -4252,6 +4275,9 @@ iterate_zap_snap (const char *name, grub_uint64_t val, + return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); + + name2 = grub_malloc (sz); ++ if (!name2) ++ return grub_errno; ++ + name2[0] = '@'; + grub_memcpy (name2 + 1, name, grub_strlen (name) + 1); + ret = ctx->hook (name2, &info, ctx->hook_data); diff --git a/0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch b/0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch new file mode 100644 index 00000000..988bcbe7 --- /dev/null +++ b/0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch @@ -0,0 +1,24 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 07:17:04 +0000 +Subject: [PATCH] fs/zfs: Add missing NULL check after grub_strdup() call + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/zfs/zfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c +index 6e6d1c921..5ff647ffb 100644 +--- a/grub-core/fs/zfs/zfs.c ++++ b/grub-core/fs/zfs/zfs.c +@@ -3309,6 +3309,8 @@ dnode_get_fullpath (const char *fullpath, struct subvolume *subvol, + filename = 0; + snapname = 0; + fsname = grub_strdup (fullpath); ++ if (!fsname) ++ return grub_errno; + } + else + { diff --git a/0344-net-Use-safe-math-macros-to-prevent-overflows.patch b/0344-net-Use-safe-math-macros-to-prevent-overflows.patch new file mode 100644 index 00000000..60ebaf63 --- /dev/null +++ b/0344-net-Use-safe-math-macros-to-prevent-overflows.patch @@ -0,0 +1,240 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 12 Feb 2025 10:38:17 -0600 +Subject: [PATCH] net: Use safe math macros to prevent overflows + +Replace direct arithmetic operations with macros from include/grub/safemath.h +to prevent potential overflow issues when calculating the memory sizes. + +Signed-off-by: Lidong Chen +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/net/bootp.c | 16 +++++++++++-- + grub-core/net/dns.c | 9 ++++++- + grub-core/net/drivers/ieee1275/ofnet.c | 20 ++++++++++++++-- + grub-core/net/net.c | 43 +++++++++++++++++++++++++++------- + 4 files changed, 75 insertions(+), 13 deletions(-) + +diff --git a/grub-core/net/bootp.c b/grub-core/net/bootp.c +index 9cbdc2264..bed70c0b2 100644 +--- a/grub-core/net/bootp.c ++++ b/grub-core/net/bootp.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + static int + dissect_url (const char *url, char **proto, char **host, char **path) +@@ -1479,6 +1480,7 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + unsigned num; + const grub_uint8_t *ptr; + grub_uint8_t taglength; ++ grub_uint8_t len; + + if (argc < 4) + return grub_error (GRUB_ERR_BAD_ARGUMENT, +@@ -1520,7 +1522,12 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + if (grub_strcmp (args[3], "string") == 0) + { + grub_err_t err = GRUB_ERR_NONE; +- char *val = grub_malloc (taglength + 1); ++ char *val; ++ ++ if (grub_add (taglength, 1, &len)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("tag length overflow")); ++ ++ val = grub_malloc (len); + if (!val) + return grub_errno; + grub_memcpy (val, ptr, taglength); +@@ -1553,7 +1560,12 @@ grub_cmd_dhcpopt (struct grub_command *cmd __attribute__ ((unused)), + if (grub_strcmp (args[3], "hex") == 0) + { + grub_err_t err = GRUB_ERR_NONE; +- char *val = grub_malloc (2 * taglength + 1); ++ char *val; ++ ++ if (grub_mul (taglength, 2, &len) || grub_add (len, 1, &len)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, N_("tag length overflow")); ++ ++ val = grub_malloc (len); + int i; + if (!val) + return grub_errno; +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index fcc09aa65..39b0c46cf 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -224,10 +224,17 @@ get_name (const grub_uint8_t *name_at, const grub_uint8_t *head, + { + int length; + char *ret; ++ int len; + + if (!check_name_real (name_at, head, tail, NULL, &length, NULL)) + return NULL; +- ret = grub_malloc (length + 1); ++ ++ if (grub_add (length, 1, &len)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("name length overflow")); ++ return NULL; ++ } ++ ret = grub_malloc (len); + if (!ret) + return NULL; + if (!check_name_real (name_at, head, tail, NULL, NULL, ret)) +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index c56461ff1..b5336dfbb 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + GRUB_MOD_LICENSE ("GPLv3+"); + +@@ -392,6 +393,7 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + grub_uint8_t *pprop; + char *shortname; + char need_suffix = 1; ++ grub_size_t sz; + + if (grub_strcmp (alias->type, "network") != 0) + return 0; +@@ -449,9 +451,23 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + } + + if (need_suffix) +- ofdata->path = grub_malloc (grub_strlen (alias->path) + sizeof (SUFFIX)); ++ { ++ if (grub_add (grub_strlen (alias->path), sizeof (SUFFIX), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obatining size of ofdata path")); ++ grub_print_error (); ++ return 0; ++ } ++ } + else +- ofdata->path = grub_malloc (grub_strlen (alias->path) + 1); ++ { ++ if (grub_add (grub_strlen (alias->path), 1, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obatining size of ofdata path")); ++ grub_print_error (); ++ return 0; ++ } ++ } + if (!ofdata->path) + { + grub_print_error (); +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 6c8dfcba2..22224453f 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + #ifdef GRUB_MACHINE_EFI + #include + #endif +@@ -211,6 +212,7 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + { + struct grub_net_slaac_mac_list *slaac; + char *ptr; ++ grub_size_t sz; + + for (slaac = card->slaac_list; slaac; slaac = slaac->next) + if (grub_net_hwaddr_cmp (&slaac->address, hwaddr) == 0) +@@ -220,9 +222,16 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + if (!slaac) + return NULL; + +- slaac->name = grub_malloc (grub_strlen (card->name) +- + GRUB_NET_MAX_STR_HWADDR_LEN +- + sizeof (":slaac")); ++ if (grub_add (grub_strlen (card->name), ++ (GRUB_NET_MAX_STR_HWADDR_LEN + sizeof (":slaac")), &sz)) ++ { ++ grub_free (slaac); ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "overflow detected while obtaining size of slaac name"); ++ return NULL; ++ } ++ ++ slaac->name = grub_malloc (sz); + ptr = grub_stpcpy (slaac->name, card->name); + if (grub_net_hwaddr_cmp (&card->default_address, hwaddr) != 0) + { +@@ -293,6 +302,7 @@ grub_net_ipv6_get_link_local (struct grub_net_card *card, + char *name; + char *ptr; + grub_net_network_level_address_t addr; ++ grub_size_t sz; + + addr.type = GRUB_NET_NETWORK_LEVEL_PROTOCOL_IPV6; + addr.ipv6[0] = grub_cpu_to_be64_compile_time (0xfe80ULL << 48); +@@ -307,9 +317,14 @@ grub_net_ipv6_get_link_local (struct grub_net_card *card, + return inf; + } + +- name = grub_malloc (grub_strlen (card->name) +- + GRUB_NET_MAX_STR_HWADDR_LEN +- + sizeof (":link")); ++ if (grub_add (grub_strlen (card->name), ++ (GRUB_NET_MAX_STR_HWADDR_LEN + sizeof (":link")), &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, ++ "overflow detected while obtaining size of link name"); ++ return NULL; ++ } ++ name = grub_malloc (sz); + if (!name) + return NULL; + +@@ -1516,9 +1531,15 @@ grub_net_open_real (const char *name) + if (grub_strchr (port_start + 1, ':')) + { + int iplen = grub_strlen (server); ++ grub_size_t sz; + + /* Bracket bare IPv6 addr. */ +- host = grub_malloc (iplen + 3); ++ if (grub_add (iplen, 3, &sz)) ++ { ++ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow detected while obtaining length of host")); ++ return NULL; ++ } ++ host = grub_malloc (sz); + if (!host) + return NULL; + +@@ -1773,6 +1794,7 @@ grub_env_set_net_property (const char *intername, const char *suffix, + { + char *varname, *varvalue; + char *ptr; ++ grub_size_t sz; + + varname = grub_xasprintf ("net_%s_%s", intername, suffix); + if (!varname) +@@ -1780,7 +1802,12 @@ grub_env_set_net_property (const char *intername, const char *suffix, + for (ptr = varname; *ptr; ptr++) + if (*ptr == ':') + *ptr = '_'; +- varvalue = grub_malloc (len + 1); ++ if (grub_add (len, 1, &sz)) ++ { ++ grub_free (varname); ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while obtaining the size of an env variable"); ++ } ++ varvalue = grub_malloc (sz); + if (!varvalue) + { + grub_free (varname); diff --git a/0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch b/0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch new file mode 100644 index 00000000..c6619d2f --- /dev/null +++ b/0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch @@ -0,0 +1,45 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 22 Jan 2025 18:04:43 +0000 +Subject: [PATCH] net: Prevent overflows when allocating memory for arrays + +Use grub_calloc() when allocating memory for arrays to ensure proper +overflow checks are in place. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/net/dns.c | 4 ++-- + grub-core/net/net.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/grub-core/net/dns.c b/grub-core/net/dns.c +index 39b0c46cf..f20cd6f83 100644 +--- a/grub-core/net/dns.c ++++ b/grub-core/net/dns.c +@@ -470,8 +470,8 @@ grub_net_dns_lookup (const char *name, + && grub_get_time_ms () < dns_cache[h].limit_time) + { + grub_dprintf ("dns", "retrieved from cache\n"); +- *addresses = grub_malloc (dns_cache[h].naddresses +- * sizeof ((*addresses)[0])); ++ *addresses = grub_calloc (dns_cache[h].naddresses, ++ sizeof ((*addresses)[0])); + if (!*addresses) + return grub_errno; + *naddresses = dns_cache[h].naddresses; +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index 22224453f..d426ad2c4 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -91,8 +91,8 @@ grub_net_link_layer_add_address (struct grub_net_card *card, + /* Add sender to cache table. */ + if (card->link_layer_table == NULL) + { +- card->link_layer_table = grub_zalloc (LINK_LAYER_CACHE_SIZE +- * sizeof (card->link_layer_table[0])); ++ card->link_layer_table = grub_calloc (LINK_LAYER_CACHE_SIZE, ++ sizeof (card->link_layer_table[0])); + if (card->link_layer_table == NULL) + return; + } diff --git a/0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch b/0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch new file mode 100644 index 00000000..7b5b647b --- /dev/null +++ b/0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 22 Jan 2025 18:04:44 +0000 +Subject: [PATCH] net: Check if returned pointer for allocated memory is NULL + +When using grub_malloc(), the function can fail if we are out of memory. +After allocating memory we should check if this function returned NULL +and handle this error if it did. + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/net/net.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/grub-core/net/net.c b/grub-core/net/net.c +index d426ad2c4..bec297cb6 100644 +--- a/grub-core/net/net.c ++++ b/grub-core/net/net.c +@@ -232,6 +232,11 @@ grub_net_ipv6_get_slaac (struct grub_net_card *card, + } + + slaac->name = grub_malloc (sz); ++ if (slaac->name == NULL) ++ { ++ grub_free (slaac); ++ return NULL; ++ } + ptr = grub_stpcpy (slaac->name, card->name); + if (grub_net_hwaddr_cmp (&card->default_address, hwaddr) != 0) + { diff --git a/0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch b/0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch new file mode 100644 index 00000000..57d2960b --- /dev/null +++ b/0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 28 Jan 2025 05:15:50 +0000 +Subject: [PATCH] fs/sfs: Check if allocated memory is NULL + +When using grub_zalloc(), if we are out of memory, this function can fail. +After allocating memory, we should check if grub_zalloc() returns NULL. +If so, we should handle this error. + +Fixes: CID 473856 + +Signed-off-by: Alec Brown +Reviewed-by: Ross Philipson +Reviewed-by: Daniel Kiper +--- + grub-core/fs/sfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c +index 88705b3a2..bad4ae8d1 100644 +--- a/grub-core/fs/sfs.c ++++ b/grub-core/fs/sfs.c +@@ -429,6 +429,9 @@ grub_sfs_mount (grub_disk_t disk) + - 24 /* offsetof (struct grub_sfs_objc, objects) */ + - 25); /* offsetof (struct grub_sfs_obj, filename) */ + data->label = grub_zalloc (max_len + 1); ++ if (data->label == NULL) ++ goto fail; ++ + grub_strncpy (data->label, (char *) rootobjc->objects[0].filename, max_len); + + grub_free (rootobjc_data); diff --git a/0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch b/0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch new file mode 100644 index 00000000..575c81a9 --- /dev/null +++ b/0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 29 Jan 2025 06:48:37 +0000 +Subject: [PATCH] script/execute: Fix potential underflow and NULL dereference + +The result is initialized to 0 in grub_script_arglist_to_argv(). +If the for loop condition is not met both result.args and result.argc +remain 0 causing result.argc - 1 to underflow and/or result.args NULL +dereference. Fix the issues by adding relevant checks. + +Fixes: CID 473880 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/script/execute.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c +index 7ed3a1a03..014132703 100644 +--- a/grub-core/script/execute.c ++++ b/grub-core/script/execute.c +@@ -794,6 +794,9 @@ cleanup: + } + } + ++ if (result.args == NULL || result.argc == 0) ++ goto fail; ++ + if (! result.args[result.argc - 1]) + result.argc--; + diff --git a/0349-osdep-unix-getroot-Fix-potential-underflow.patch b/0349-osdep-unix-getroot-Fix-potential-underflow.patch new file mode 100644 index 00000000..09c223ea --- /dev/null +++ b/0349-osdep-unix-getroot-Fix-potential-underflow.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Wed, 29 Jan 2025 06:48:38 +0000 +Subject: [PATCH] osdep/unix/getroot: Fix potential underflow + +The entry_len is initialized in grub_find_root_devices_from_mountinfo() +to 0 before the while loop iterates through /proc/self/mountinfo. If the +file is empty or contains only invalid entries entry_len remains +0 causing entry_len - 1 in the subsequent for loop initialization +to underflow. To prevent this add a check to ensure entry_len > 0 before +entering the for loop. + +Fixes: CID 473877 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +Reviewed-by: Ross Philipson +--- + grub-core/osdep/linux/getroot.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index b32582eb3..b83259321 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -596,6 +596,9 @@ again: + } + } + ++ if (!entry_len) ++ goto out; ++ + /* Now scan visible mounts for the ones we're interested in. */ + for (i = entry_len - 1; i >= 0; i--) + { diff --git a/0350-misc-Ensure-consistent-overflow-error-messages.patch b/0350-misc-Ensure-consistent-overflow-error-messages.patch new file mode 100644 index 00000000..411a4fbc --- /dev/null +++ b/0350-misc-Ensure-consistent-overflow-error-messages.patch @@ -0,0 +1,55 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Tue, 21 Jan 2025 19:02:39 +0000 +Subject: [PATCH] misc: Ensure consistent overflow error messages + +Update the overflow error messages to make them consistent +across the GRUB code. + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ntfs.c | 2 +- + grub-core/fs/ntfscomp.c | 2 +- + grub-core/video/readers/png.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c +index e00349b1d..960833a34 100644 +--- a/grub-core/fs/ntfs.c ++++ b/grub-core/fs/ntfs.c +@@ -574,7 +574,7 @@ retry: + goto retry; + } + } +- return grub_error (GRUB_ERR_BAD_FS, "run list overflown"); ++ return grub_error (GRUB_ERR_BAD_FS, "run list overflow"); + } + ctx->curr_vcn = ctx->next_vcn; + ctx->next_vcn += read_run_data (run, c1, 0); /* length of current VCN */ +diff --git a/grub-core/fs/ntfscomp.c b/grub-core/fs/ntfscomp.c +index f168a318e..b68bf5e40 100644 +--- a/grub-core/fs/ntfscomp.c ++++ b/grub-core/fs/ntfscomp.c +@@ -30,7 +30,7 @@ static grub_err_t + decomp_nextvcn (struct grub_ntfs_comp *cc) + { + if (cc->comp_head >= cc->comp_tail) +- return grub_error (GRUB_ERR_BAD_FS, "compression block overflown"); ++ return grub_error (GRUB_ERR_BAD_FS, "compression block overflow"); + if (grub_disk_read + (cc->disk, + (cc->comp_table[cc->comp_head].next_lcn - +diff --git a/grub-core/video/readers/png.c b/grub-core/video/readers/png.c +index 3163e97bf..aa7524b7d 100644 +--- a/grub-core/video/readers/png.c ++++ b/grub-core/video/readers/png.c +@@ -626,7 +626,7 @@ static grub_err_t + grub_png_output_byte (struct grub_png_data *data, grub_uint8_t n) + { + if (--data->raw_bytes < 0) +- return grub_error (GRUB_ERR_BAD_FILE_TYPE, "image size overflown"); ++ return grub_error (GRUB_ERR_BAD_FILE_TYPE, "image size overflow"); + + if (data->cur_column == 0) + { diff --git a/0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch b/0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch new file mode 100644 index 00000000..70342514 --- /dev/null +++ b/0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 4 Feb 2025 15:11:10 +0000 +Subject: [PATCH] bus/usb/ehci: Define GRUB_EHCI_TOGGLE as grub_uint32_t + +The Coverity indicates that GRUB_EHCI_TOGGLE is an int that contains +a negative value and we are using it for the variable token which is +grub_uint32_t. To remedy this we can cast the definition to grub_uint32_t. + +Fixes: CID 473851 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/bus/usb/ehci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/bus/usb/ehci.c b/grub-core/bus/usb/ehci.c +index 9abebc6bd..2db07c7c0 100644 +--- a/grub-core/bus/usb/ehci.c ++++ b/grub-core/bus/usb/ehci.c +@@ -218,7 +218,7 @@ enum + + #define GRUB_EHCI_TERMINATE (1<<0) + +-#define GRUB_EHCI_TOGGLE (1<<31) ++#define GRUB_EHCI_TOGGLE ((grub_uint32_t) 1<<31) + + enum + { diff --git a/0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch b/0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch new file mode 100644 index 00000000..2ae5ec6f --- /dev/null +++ b/0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch @@ -0,0 +1,41 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Tue, 4 Feb 2025 15:11:11 +0000 +Subject: [PATCH] normal/menu: Use safe math to avoid an integer overflow + +The Coverity indicates that the variable current_entry might overflow. +To prevent this use safe math when adding GRUB_MENU_PAGE_SIZE to current_entry. + +On the occasion fix limiting condition which was broken. + +Fixes: CID 473853 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/normal/menu.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c +index cda10fa8b..97687013c 100644 +--- a/grub-core/normal/menu.c ++++ b/grub-core/normal/menu.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + /* Time to delay after displaying an error message about a default/fallback + entry failing to boot. */ +@@ -784,9 +785,7 @@ run_menu (grub_menu_t menu, int nested, int *auto_boot, int *notify_boot) + + case GRUB_TERM_CTRL | 'c': + case GRUB_TERM_KEY_NPAGE: +- if (current_entry + GRUB_MENU_PAGE_SIZE < menu->size) +- current_entry += GRUB_MENU_PAGE_SIZE; +- else ++ if (grub_add (current_entry, GRUB_MENU_PAGE_SIZE, ¤t_entry) || current_entry >= menu->size) + current_entry = menu->size - 1; + menu_set_chosen_entry (current_entry); + break; diff --git a/0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch b/0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch new file mode 100644 index 00000000..a170fa95 --- /dev/null +++ b/0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Thu, 6 Feb 2025 18:16:56 +0000 +Subject: [PATCH] kern/partition: Add sanity check after grub_strtoul() call + +The current code incorrectly assumes that both the input and the values +returned by grub_strtoul() are always valid which can lead to potential +errors. This fix ensures proper validation to prevent any unintended issues. + +Fixes: CID 473843 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/kern/partition.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/partition.c b/grub-core/kern/partition.c +index 704512a20..c6a578cf4 100644 +--- a/grub-core/kern/partition.c ++++ b/grub-core/kern/partition.c +@@ -125,14 +125,22 @@ grub_partition_probe (struct grub_disk *disk, const char *str) + for (ptr = str; *ptr;) + { + grub_partition_map_t partmap; +- int num; ++ unsigned long num; + const char *partname, *partname_end; + + partname = ptr; + while (*ptr && grub_isalpha (*ptr)) + ptr++; + partname_end = ptr; +- num = grub_strtoul (ptr, &ptr, 0) - 1; ++ ++ num = grub_strtoul (ptr, &ptr, 0); ++ if (*ptr != '\0' || num == 0 || num > GRUB_INT_MAX) ++ { ++ grub_error (GRUB_ERR_BAD_NUMBER, N_("invalid partition number")); ++ return 0; ++ } ++ ++ num -= 1; + + curpart = 0; + /* Use the first partition map type found. */ diff --git a/0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch b/0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch new file mode 100644 index 00000000..7af2fd0b --- /dev/null +++ b/0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch @@ -0,0 +1,57 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Lidong Chen +Date: Thu, 6 Feb 2025 18:16:57 +0000 +Subject: [PATCH] kern/misc: Add sanity check after grub_strtoul() call + +When the format string, fmt0, includes a positional argument +grub_strtoul() or grub_strtoull() is called to extract the argument +position. However, the returned argument position isn't fully validated. +If the format is something like "%0$x" then these functions return +0 which leads to an underflow in the calculation of the args index, curn. +The fix is to add a check to ensure the extracted argument position is +greater than 0 before computing curn. Additionally, replace one +grub_strtoull() with grub_strtoul() and change curn type to make code +more correct. + +Fixes: CID 473841 + +Signed-off-by: Lidong Chen +Reviewed-by: Daniel Kiper +--- + grub-core/kern/misc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/grub-core/kern/misc.c b/grub-core/kern/misc.c +index 98700423d..69bd655f3 100644 +--- a/grub-core/kern/misc.c ++++ b/grub-core/kern/misc.c +@@ -912,7 +912,7 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + while ((c = *fmt++) != 0) + { + int longfmt = 0; +- grub_size_t curn; ++ unsigned long curn; + const char *p; + + if (c != '%') +@@ -930,7 +930,10 @@ parse_printf_arg_fmt (const char *fmt0, struct printf_args *args, + + if (*fmt == '$') + { +- curn = grub_strtoull (p, 0, 10) - 1; ++ curn = grub_strtoul (p, 0, 10); ++ if (curn == 0) ++ continue; ++ curn--; + fmt++; + } + +@@ -1116,6 +1119,8 @@ grub_vsnprintf_real (char *str, grub_size_t max_len, const char *fmt0, + + if (*fmt == '$') + { ++ if (format1 == 0) ++ continue; + curn = format1 - 1; + fmt++; + format1 = 0; diff --git a/0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch b/0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch new file mode 100644 index 00000000..9c8819bb --- /dev/null +++ b/0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch @@ -0,0 +1,30 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 12 Feb 2025 10:56:13 -0600 +Subject: [PATCH] loader/i386/linux: Cast left shift to grub_uint32_t + +The Coverity complains that we might overflow into a negative value when +setting linux_params.kernel_alignment to (1 << align). We can remedy +this by casting it to grub_uint32_t. + +Fixes: CID 473876 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/loader/i386/linux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/loader/i386/linux.c b/grub-core/loader/i386/linux.c +index 90121e9bc..33a852197 100644 +--- a/grub-core/loader/i386/linux.c ++++ b/grub-core/loader/i386/linux.c +@@ -823,7 +823,7 @@ grub_cmd_linux (grub_command_t cmd __attribute__ ((unused)), + GRUB_MEM_ATTR_R|GRUB_MEM_ATTR_W, GRUB_MEM_ATTR_X); + + linux_params.code32_start = prot_mode_target + lh.code32_start - GRUB_LINUX_BZIMAGE_ADDR; +- linux_params.kernel_alignment = (1 << align); ++ linux_params.kernel_alignment = ((grub_uint32_t)1 << align); + linux_params.ps_mouse = linux_params.padding11 = 0; + linux_params.type_of_loader = GRUB_LINUX_BOOT_LOADER_TYPE; + diff --git a/0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch b/0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch new file mode 100644 index 00000000..272293b2 --- /dev/null +++ b/0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch @@ -0,0 +1,56 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Wed, 5 Feb 2025 22:04:08 +0000 +Subject: [PATCH] loader/i386/bsd: Use safe math to avoid underflow + +The operation kern_end - kern_start may underflow when we input it into +grub_relocator_alloc_chunk_addr() call. To avoid this we can use safe +math for this subtraction. + +Fixes: CID 73845 + +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/loader/i386/bsd.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/grub-core/loader/i386/bsd.c b/grub-core/loader/i386/bsd.c +index 8075ac9b0..50f96ea7a 100644 +--- a/grub-core/loader/i386/bsd.c ++++ b/grub-core/loader/i386/bsd.c +@@ -1341,6 +1341,7 @@ static grub_err_t + grub_bsd_load_elf (grub_elf_t elf, const char *filename) + { + grub_err_t err; ++ grub_size_t sz; + + kern_end = 0; + kern_start = ~0; +@@ -1371,8 +1372,11 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) + + if (grub_errno) + return grub_errno; +- err = grub_relocator_alloc_chunk_addr (relocator, &ch, +- kern_start, kern_end - kern_start); ++ ++ if (grub_sub (kern_end, kern_start, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while determining size of kernel for relocator"); ++ ++ err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, sz); + if (err) + return err; + +@@ -1432,8 +1436,10 @@ grub_bsd_load_elf (grub_elf_t elf, const char *filename) + { + grub_relocator_chunk_t ch; + +- err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, +- kern_end - kern_start); ++ if (grub_sub (kern_end, kern_start, &sz)) ++ return grub_error (GRUB_ERR_OUT_OF_RANGE, "underflow detected while determining size of kernel for relocator"); ++ ++ err = grub_relocator_alloc_chunk_addr (relocator, &ch, kern_start, sz); + if (err) + return err; + kern_chunk_src = get_virtual_current_address (ch); diff --git a/grub.patches b/grub.patches index 45df8060..b0e13292 100644 --- a/grub.patches +++ b/grub.patches @@ -281,3 +281,76 @@ Patch0280: 0280-Enable-building-blscfg-module-on-xen-and-xen_pvh.patch Patch0281: 0281-loader-efi-Fix-RISC-V-build.patch Patch0282: 0282-kern-riscv-efi-init-Use-time-register-in-grub_efi_ge.patch Patch0283: 0283-Use-medany-instead-of-large-model-for-RISCV.patch +Patch0284: 0284-misc-Implement-grub_strlcpy.patch +Patch0285: 0285-fs-ufs-Fix-a-heap-OOB-write.patch +Patch0286: 0286-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch +Patch0287: 0287-fs-tar-Initialize-name-in-grub_cpio_find_file.patch +Patch0288: 0288-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0289: 0289-fs-f2fs-Set-a-grub_errno-if-mount-fails.patch +Patch0290: 0290-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch +Patch0291: 0291-fs-iso9660-Set-a-grub_errno-if-mount-fails.patch +Patch0292: 0292-fs-iso9660-Fix-invalid-free.patch +Patch0293: 0293-fs-jfs-Fix-OOB-read-in-jfs_getent.patch +Patch0294: 0294-fs-jfs-Fix-OOB-read-caused-by-invalid-dir-slot-index.patch +Patch0295: 0295-fs-jfs-Use-full-40-bits-offset-and-address-for-a-dat.patch +Patch0296: 0296-fs-jfs-Inconsistent-signed-unsigned-types-usage-in-r.patch +Patch0297: 0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch +Patch0298: 0298-fs-ntfs-Fix-out-of-bounds-read.patch +Patch0299: 0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch +Patch0300: 0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch +Patch0301: 0301-fs-ntfs-Implement-attribute-verification.patch +Patch0302: 0302-fs-xfs-Fix-out-of-bounds-read.patch +Patch0303: 0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch +Patch0304: 0304-kern-file-Ensure-file-data-is-set.patch +Patch0305: 0305-kern-file-Implement-filesystem-reference-counting.patch +Patch0306: 0306-cli_lock-Add-build-option-to-block-command-line-inte.patch +Patch0307: 0307-disk-cryptodisk-Require-authentication-after-TPM-unl.patch +Patch0308: 0308-disk-loopback-Reference-tracking-for-the-loopback.patch +Patch0309: 0309-kern-disk-Limit-recursion-depth.patch +Patch0310: 0310-kern-partition-Limit-recursion-in-part_iterate.patch +Patch0311: 0311-script-execute-Limit-the-recursion-depth.patch +Patch0312: 0312-net-Unregister-net_default_ip-and-net_default_mac-va.patch +Patch0313: 0313-net-Remove-variables-hooks-when-interface-is-unregis.patch +Patch0314: 0314-net-Fix-OOB-write-in-grub_net_search_config_file.patch +Patch0315: 0315-net-tftp-Fix-stack-buffer-overflow-in-tftp_open.patch +Patch0316: 0316-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch +Patch0317: 0317-kern-dl-Fix-for-an-integer-overflow-in-grub_dl_ref.patch +Patch0318: 0318-kern-dl-Check-for-the-SHF_INFO_LINK-flag-in-grub_dl_.patch +Patch0319: 0319-commands-extcmd-Missing-check-for-failed-allocation.patch +Patch0320: 0320-commands-ls-Fix-NULL-dereference.patch +Patch0321: 0321-commands-pgp-Unregister-the-check_signatures-hooks-o.patch +Patch0322: 0322-normal-Remove-variables-hooks-on-module-unload.patch +Patch0323: 0323-gettext-Remove-variables-hooks-on-module-unload.patch +Patch0324: 0324-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch +Patch0325: 0325-gettext-Integer-overflow-leads-to-heap-OOB-write.patch +Patch0326: 0326-commands-read-Fix-an-integer-overflow-when-supplying.patch +Patch0327: 0327-commands-test-Stack-overflow-due-to-unlimited-recurs.patch +Patch0328: 0328-commands-minicmd-Block-the-dump-command-in-lockdown-.patch +Patch0329: 0329-commands-memrw-Disable-memory-reading-in-lockdown-mo.patch +Patch0330: 0330-commands-hexdump-Disable-memory-reading-in-lockdown-.patch +Patch0331: 0331-fs-bfs-Disable-under-lockdown.patch +Patch0332: 0332-fs-Disable-many-filesystems-under-lockdown.patch +Patch0333: 0333-disk-Use-safe-math-macros-to-prevent-overflows.patch +Patch0334: 0334-disk-Prevent-overflows-when-allocating-memory-for-ar.patch +Patch0335: 0335-disk-Check-if-returned-pointer-for-allocated-memory-.patch +Patch0336: 0336-disk-ieee1275-ofdisk-Call-grub_ieee1275_close-when-g.patch +Patch0337: 0337-fs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0338: 0338-fs-Prevent-overflows-when-allocating-memory-for-arra.patch +Patch0339: 0339-fs-Prevent-overflows-when-assigning-returned-values-.patch +Patch0340: 0340-fs-zfs-Use-safe-math-macros-to-prevent-overflows.patch +Patch0341: 0341-fs-zfs-Prevent-overflows-when-allocating-memory-for-.patch +Patch0342: 0342-fs-zfs-Check-if-returned-pointer-for-allocated-memor.patch +Patch0343: 0343-fs-zfs-Add-missing-NULL-check-after-grub_strdup-call.patch +Patch0344: 0344-net-Use-safe-math-macros-to-prevent-overflows.patch +Patch0345: 0345-net-Prevent-overflows-when-allocating-memory-for-arr.patch +Patch0346: 0346-net-Check-if-returned-pointer-for-allocated-memory-i.patch +Patch0347: 0347-fs-sfs-Check-if-allocated-memory-is-NULL.patch +Patch0348: 0348-script-execute-Fix-potential-underflow-and-NULL-dere.patch +Patch0349: 0349-osdep-unix-getroot-Fix-potential-underflow.patch +Patch0350: 0350-misc-Ensure-consistent-overflow-error-messages.patch +Patch0351: 0351-bus-usb-ehci-Define-GRUB_EHCI_TOGGLE-as-grub_uint32_.patch +Patch0352: 0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch +Patch0353: 0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch +Patch0354: 0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch +Patch0355: 0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch +Patch0356: 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch \ No newline at end of file diff --git a/grub2.spec b/grub2.spec index 55879ec3..a62e4828 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 17%{?dist} +Release: 18%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,14 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Tue Feb 18 2025 Leo Sandoval - 2.12-18 +- Add Several CVE fixes +- Resolves: CVE-2024-45781 CVE-2024-45783 CVE-2024-45778 +- Resolves: CVE-2024-45775 CVE-2024-45780 CVE-2024-45774 +- Resolves: CVE-2025-0690 CVE-2025-1118 CVE-2024-45782 +- Resolves: CVE-2025-0624 CVE-2024-45779 CVE-2024-45776 +- Resolves: CVE-2025-0622 CVE-2025-0677 + * Wed Nov 27 2024 Marta Lewandowska - 2.12-17 - 99-grub-mkconfig.install: on PPC systems, remove petiboot's version checks From 45ceb182d4351105d241b08bff74268f20f655bb Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 25 Feb 2025 16:15:57 +0100 Subject: [PATCH 04/10] fs/ext2: Rework out-of-bounds read for inline and external extents Resolves: #2346804 Signed-off-by: Nicolas Frayer --- ...ut-of-bounds-read-for-inline-and-ext.patch | 65 +++++++++++++++++++ grub.patches | 3 +- grub2.spec | 6 +- 3 files changed, 72 insertions(+), 2 deletions(-) create mode 100644 0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch diff --git a/0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch b/0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch new file mode 100644 index 00000000..c237f462 --- /dev/null +++ b/0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch @@ -0,0 +1,65 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Michael Chang via Grub-devel +Date: Fri, 21 Feb 2025 09:06:12 +0800 +Subject: [PATCH] fs/ext2: Rework out-of-bounds read for inline and external + extents + +Previously, the number of extent entries was not properly capped based +on the actual available space. This could lead to insufficient reads for +external extents, since the computation was based solely on the inline +extent layout. + +In this patch, when processing the extent header, we determine whether +the header is stored inline (i.e., at inode->blocks.dir_blocks) or in an +external extent block. We then clamp the number of entries accordingly +(using max_inline_ext for inline extents and max_external_ext for +external extent blocks). + +This change ensures that only the valid number of extent entries is +processed, preventing out-of-bound reads and potential filesystem +corruption. + +Fixes: 7e2f750f0a (fs/ext2: Fix out-of-bounds read for inline extents) + +Signed-off-by: Michael Chang +Tested-by: Christian Hesse +Reviewed-by: Daniel Kiper +--- + grub-core/fs/ext2.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/grub-core/fs/ext2.c b/grub-core/fs/ext2.c +index c3058f7..a5650c3 100644 +--- a/grub-core/fs/ext2.c ++++ b/grub-core/fs/ext2.c +@@ -496,7 +496,10 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + int i; + grub_disk_addr_t ret; + grub_uint16_t nent; ++ /* maximum number of extent entries in the inode's inline extent area */ + const grub_uint16_t max_inline_ext = sizeof (inode->blocks) / sizeof (*ext) - 1; /* Minus 1 extent header. */ ++ /* maximum number of extent entries in the external extent block */ ++ const grub_uint16_t max_external_ext = EXT2_BLOCK_SIZE(data) / sizeof (*ext) - 1; /* Minus 1 extent header. */ + + if (grub_ext4_find_leaf (data, (struct grub_ext4_extent_header *) inode->blocks.dir_blocks, + fileblock, &leaf) != GRUB_ERR_NONE) +@@ -513,8 +516,18 @@ grub_ext2_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) + + nent = grub_le_to_cpu16 (leaf->entries); + +- if (leaf->depth == 0) ++ /* ++ * Determine the effective number of extent entries (nent) to process: ++ * If the extent header (leaf) is stored inline in the inode’s block ++ * area (i.e. at inode->blocks.dir_blocks), then only max_inline_ext ++ * entries can fit. ++ * Otherwise, if the header was read from an external extent block, use ++ * the larger limit, max_external_ext, based on the full block size. ++ */ ++ if (leaf == (struct grub_ext4_extent_header *) inode->blocks.dir_blocks) + nent = grub_min (nent, max_inline_ext); ++ else ++ nent = grub_min (nent, max_external_ext); + + for (i = 0; i < nent; i++) + { diff --git a/grub.patches b/grub.patches index b0e13292..66051756 100644 --- a/grub.patches +++ b/grub.patches @@ -353,4 +353,5 @@ Patch0352: 0352-normal-menu-Use-safe-math-to-avoid-an-integer-overfl.patch Patch0353: 0353-kern-partition-Add-sanity-check-after-grub_strtoul-c.patch Patch0354: 0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch Patch0355: 0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch -Patch0356: 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch \ No newline at end of file +Patch0356: 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch +Patch0357: 0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch diff --git a/grub2.spec b/grub2.spec index a62e4828..42efd655 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 18%{?dist} +Release: 19%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Tue Feb 25 2025 Nicolas Frayer 2.12-19 +- fs/ext2: Rework out-of-bounds read for inline and external extents +- Resolves: #2346804 + * Tue Feb 18 2025 Leo Sandoval - 2.12-18 - Add Several CVE fixes - Resolves: CVE-2024-45781 CVE-2024-45783 CVE-2024-45778 From cdd4d755fbcda1785a03da91c0391afc8fc397fa Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Mon, 10 Mar 2025 12:48:56 -0600 Subject: [PATCH 05/10] Remove NTFS attribute verification patch The removed patch was part of the CVE patches ported recently into Fedora but unfortunately this is causing segfaults when generating the grub configuration file. At some point the same patch will come back with the corresponding fix but for the time being, it is removed. Note that patch numeration did not change on purpose: patch will be introduced again so need to mess with the numeration. Resolves: #2350327 Signed-off-by: Leo Sandoval --- ...tfs-Implement-attribute-verification.patch | 245 ------------------ grub.patches | 1 - grub2.spec | 6 +- 3 files changed, 5 insertions(+), 247 deletions(-) delete mode 100644 0301-fs-ntfs-Implement-attribute-verification.patch diff --git a/0301-fs-ntfs-Implement-attribute-verification.patch b/0301-fs-ntfs-Implement-attribute-verification.patch deleted file mode 100644 index 4ee1c392..00000000 --- a/0301-fs-ntfs-Implement-attribute-verification.patch +++ /dev/null @@ -1,245 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: B Horn -Date: Tue, 14 May 2024 12:39:56 +0100 -Subject: [PATCH] fs/ntfs: Implement attribute verification - -It was possible to read OOB when an attribute had a size that exceeded -the allocated buffer. This resolves that by making sure all attributes -that get read are fully in the allocated space by implementing -a function to validate them. - -Defining the offsets in include/grub/ntfs.h but they are only used in -the validation function and not across the rest of the NTFS code. - -Signed-off-by: B Horn -Reviewed-by: Daniel Kiper ---- - grub-core/fs/ntfs.c | 153 ++++++++++++++++++++++++++++++++++++++++++++++++++++ - include/grub/ntfs.h | 22 ++++++++ - 2 files changed, 175 insertions(+) - -diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c -index 1c678f3d0..64f4f2221 100644 ---- a/grub-core/fs/ntfs.c -+++ b/grub-core/fs/ntfs.c -@@ -70,6 +70,149 @@ res_attr_data_len (void *res_attr_ptr) - return u32at (res_attr_ptr, 0x10); - } - -+/* -+ * Check if the attribute is valid and doesn't exceed the allocated region. -+ * This accounts for resident and non-resident data. -+ * -+ * This is based off the documentation from the linux-ntfs project: -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html -+ */ -+static bool -+validate_attribute (grub_uint8_t *attr, void *end) -+{ -+ grub_size_t attr_size = 0; -+ grub_size_t min_size = 0; -+ grub_size_t spare = (grub_uint8_t *) end - attr; -+ /* -+ * Just used as a temporary variable to try and deal with cases where someone -+ * tries to overlap fields. -+ */ -+ grub_size_t curr = 0; -+ -+ /* Need verify we can entirely read the attributes header. */ -+ if (attr + GRUB_NTFS_ATTRIBUTE_HEADER_SIZE >= (grub_uint8_t *) end) -+ goto fail; -+ -+ /* -+ * So, the rest of this code uses a 16bit int for the attribute length but -+ * from reading the all the documentation I could find it says this field is -+ * actually 32bit. But let's be consistent with the rest of the code. -+ * -+ * https://elixir.bootlin.com/linux/v6.10.7/source/fs/ntfs3/ntfs.h#L370 -+ */ -+ attr_size = u16at (attr, GRUB_NTFS_ATTRIBUTE_LENGTH); -+ -+ if (attr_size > spare) -+ goto fail; -+ -+ /* Not an error case, just reached the end of the attributes. */ -+ if (attr_size == 0) -+ return false; -+ -+ /* -+ * Extra validation by trying to calculate a minimum possible size for this -+ * attribute. +8 from the size of the resident data struct which is the -+ * minimum that can be added. -+ */ -+ min_size = GRUB_NTFS_ATTRIBUTE_HEADER_SIZE + 8; -+ -+ if (min_size > attr_size) -+ goto fail; -+ -+ /* Is the data is resident (0) or not (1). */ -+ if (attr[GRUB_NTFS_ATTRIBUTE_RESIDENT] == 0) -+ { -+ /* Read the offset and size of the attribute. */ -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_RES_OFFSET); -+ curr += u32at (attr, GRUB_NTFS_ATTRIBUTE_RES_LENGTH); -+ if (curr > min_size) -+ min_size = curr; -+ } -+ else -+ { -+ /* -+ * If the data is non-resident, the minimum size is 64 which is where -+ * the data runs start. We already have a minimum size of 24. So, just -+ * adding 40 to get to the real value. -+ */ -+ min_size += 40; -+ if (min_size > attr_size) -+ goto fail; -+ /* If the compression unit size is > 0, +8 bytes*/ -+ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE) > 0) -+ min_size += 8; -+ -+ /* -+ * Need to consider the data runs now. Each member of the run has byte -+ * that describes the size of the data length and offset. Each being -+ * 4 bits in the byte. -+ */ -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_DATA_RUNS); -+ -+ if (curr + 1 > min_size) -+ min_size = curr + 1; -+ -+ if (min_size > attr_size) -+ goto fail; -+ -+ /* -+ * Each attribute can store multiple data runs which are stored -+ * continuously in the attribute. They exist as one header byte -+ * with up to 14 bytes following it depending on the lengths. -+ * We stop when we hit a header that is just a NUL byte. -+ * -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/data_runs.html -+ */ -+ while (attr[curr] != 0) -+ { -+ /* -+ * We stop when we hit a header that is just a NUL byte. The data -+ * run header is stored as a single byte where the top 4 bits refer -+ * to the number of bytes used to store the total length of the -+ * data run, and the number of bytes used to store the offset. -+ * These directly follow the header byte, so we use them to update -+ * the minimum size. -+ */ -+ min_size += (attr[curr] & 0x7) + ((attr[curr] >> 4) & 0x7); -+ curr += min_size; -+ min_size++; -+ if (min_size > attr_size) -+ goto fail; -+ } -+ } -+ -+ /* Name offset, doing this after data residence checks. */ -+ if (u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET) != 0) -+ { -+ curr = u16at (attr, GRUB_NTFS_ATTRIBUTE_NAME_OFFSET); -+ /* -+ * Multiple the name length by 2 as its UTF-16. Can be zero if this in an -+ * unamed attribute. -+ */ -+ curr += attr[GRUB_NTFS_ATTRIBUTE_NAME_LENGTH] * 2; -+ if (curr > min_size) -+ min_size = curr; -+ } -+ -+ /* Padded to 8 bytes. */ -+ if (min_size % 8 != 0) -+ min_size += 8 - (min_size % 8); -+ -+ /* -+ * At this point min_size should be exactly attr_size but being flexible -+ * here to avoid any issues. -+ */ -+ if (min_size > attr_size) -+ goto fail; -+ -+ return true; -+ -+ fail: -+ grub_dprintf ("ntfs", "spare=%" PRIuGRUB_SIZE " min_size=%" PRIuGRUB_SIZE " attr_size=%" PRIuGRUB_SIZE "\n", -+ spare, min_size, attr_size); -+ return false; -+} -+ - /* Return the next attribute if it exists, otherwise return NULL. */ - static grub_uint8_t * - next_attribute (grub_uint8_t *curr_attribute, void *end) -@@ -84,6 +227,8 @@ next_attribute (grub_uint8_t *curr_attribute, void *end) - return NULL; - - next += u16at (curr_attribute, 4); -+ if (validate_attribute (next, end) == false) -+ return NULL; - - return next; - } -@@ -290,6 +435,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) - /* From this point on pa_end is the end of the buffer */ - at->end = pa_end; - -+ if (validate_attribute (at->attr_nxt, pa_end) == false) -+ return NULL; -+ - while (at->attr_nxt) - { - if ((*at->attr_nxt == attr) || (attr == 0)) -@@ -319,6 +467,9 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) - + 1)); - pa = at->attr_nxt + u16at (pa, 4); - -+ if (validate_attribute (pa, pa_end) == true) -+ pa = NULL; -+ - while (pa) - { - if (*pa != attr) -@@ -572,6 +723,8 @@ read_attr (struct grub_ntfs_attr *at, grub_uint8_t *dest, grub_disk_addr_t ofs, - else - vcn = ofs >> (at->mft->data->log_spc + GRUB_NTFS_BLK_SHR); - pa = at->attr_nxt + u16at (at->attr_nxt, 4); -+ if (validate_attribute (pa, at->attr_end) == false) -+ pa = NULL; - - while (pa) - { -diff --git a/include/grub/ntfs.h b/include/grub/ntfs.h -index 2c8078403..77b182acf 100644 ---- a/include/grub/ntfs.h -+++ b/include/grub/ntfs.h -@@ -91,6 +91,28 @@ enum - - #define GRUB_NTFS_ATTRIBUTE_HEADER_SIZE 16 - -+/* -+ * To make attribute validation clearer the offsets for each value in the -+ * attribute headers are defined as macros. -+ * -+ * These offsets are all from: -+ * https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html -+ */ -+ -+/* These offsets are part of the attribute header. */ -+#define GRUB_NTFS_ATTRIBUTE_LENGTH 4 -+#define GRUB_NTFS_ATTRIBUTE_RESIDENT 8 -+#define GRUB_NTFS_ATTRIBUTE_NAME_LENGTH 9 -+#define GRUB_NTFS_ATTRIBUTE_NAME_OFFSET 10 -+ -+/* Offsets for values needed for resident data. */ -+#define GRUB_NTFS_ATTRIBUTE_RES_LENGTH 16 -+#define GRUB_NTFS_ATTRIBUTE_RES_OFFSET 20 -+ -+/* Offsets for values needed for non-resident data. */ -+#define GRUB_NTFS_ATTRIBUTE_DATA_RUNS 32 -+#define GRUB_NTFS_ATTRIBUTE_COMPRESSION_UNIT_SIZE 34 -+ - enum - { - GRUB_NTFS_AF_ALST = 1, diff --git a/grub.patches b/grub.patches index 66051756..a9295f33 100644 --- a/grub.patches +++ b/grub.patches @@ -298,7 +298,6 @@ Patch0297: 0297-fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch Patch0298: 0298-fs-ntfs-Fix-out-of-bounds-read.patch Patch0299: 0299-fs-ntfs-Track-the-end-of-the-MFT-attribute-buffer.patch Patch0300: 0300-fs-ntfs-Use-a-helper-function-to-access-attributes.patch -Patch0301: 0301-fs-ntfs-Implement-attribute-verification.patch Patch0302: 0302-fs-xfs-Fix-out-of-bounds-read.patch Patch0303: 0303-fs-xfs-Ensuring-failing-to-mount-sets-a-grub_errno.patch Patch0304: 0304-kern-file-Ensure-file-data-is-set.patch diff --git a/grub2.spec b/grub2.spec index 42efd655..c2cfb02b 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 19%{?dist} +Release: 20%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Mon Mar 10 2025 Leo Sandoval 2.12-20 +- Remove 'fs/ntfs: Implement attribute verification' patch +- Resolves: #2350327 + * Tue Feb 25 2025 Nicolas Frayer 2.12-19 - fs/ext2: Rework out-of-bounds read for inline and external extents - Resolves: #2346804 From debcc8e166987fcb56d6fb3167f1b7017ee06d98 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Thu, 27 Mar 2025 10:52:11 +0100 Subject: [PATCH 06/10] ieee1275/ofnet: Fix grub_malloc() removed after added safe Signed-off-by: Nicolas Frayer --- ...ix-grub_malloc-removed-after-added-s.patch | 32 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 ++- 3 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch diff --git a/0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch b/0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch new file mode 100644 index 00000000..92da0261 --- /dev/null +++ b/0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Wed, 19 Mar 2025 17:39:41 +0100 +Subject: [PATCH] ieee1275/ofnet: Fix grub_malloc() removed after added safe + math functions + +grub_malloc() has been inadvertently removed from the ieee1275/ofnet +code after it has been modified to use safe match function. + +Fixes: 4beeff8a (net: Use safe math macros to prevent overflows) + +Tested-by: Marta Lewandowska +Reviewed-by: Daniel Kiper +Signed-off-by: Nicolas Frayer +--- + grub-core/net/drivers/ieee1275/ofnet.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/grub-core/net/drivers/ieee1275/ofnet.c b/grub-core/net/drivers/ieee1275/ofnet.c +index 3e1b9094e2ab..37bc82467f60 100644 +--- a/grub-core/net/drivers/ieee1275/ofnet.c ++++ b/grub-core/net/drivers/ieee1275/ofnet.c +@@ -463,6 +463,9 @@ search_net_devices (struct grub_ieee1275_devalias *alias) + return 0; + } + } ++ ++ ofdata->path = grub_malloc(sz); ++ + if (!ofdata->path) + { + grub_print_error (); diff --git a/grub.patches b/grub.patches index a9295f33..2a52ab1f 100644 --- a/grub.patches +++ b/grub.patches @@ -354,3 +354,4 @@ Patch0354: 0354-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch Patch0355: 0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch Patch0356: 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch Patch0357: 0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch +Patch0358: 0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch diff --git a/grub2.spec b/grub2.spec index c2cfb02b..dda59534 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 20%{?dist} +Release: 21%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Tue Mar 25 2025 Nicolas Frayer 2.12-21 +- ieee1275/ofnet: Fix grub_malloc() removed after added safe + * Mon Mar 10 2025 Leo Sandoval 2.12-20 - Remove 'fs/ntfs: Implement attribute verification' patch - Resolves: #2350327 From 497a24edb2b6e679787cf292dc7d5a98c0ec2ac7 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Mon, 19 May 2025 19:02:29 +0200 Subject: [PATCH 07/10] sbat: bump grub sbat Signed-off-by: Nicolas Frayer --- grub2.spec | 5 ++++- sbat.csv.in | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/grub2.spec b/grub2.spec index dda59534..e5430fea 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 21%{?dist} +Release: 22%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Mon May 19 2025 Nicolas Frayer 2.12-22 +- sbat: bump grub sbat + * Tue Mar 25 2025 Nicolas Frayer 2.12-21 - ieee1275/ofnet: Fix grub_malloc() removed after added safe diff --git a/sbat.csv.in b/sbat.csv.in index b338b5f5..f8372dfd 100755 --- a/sbat.csv.in +++ b/sbat.csv.in @@ -1,3 +1,3 @@ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/ +grub,5,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/ grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com From 279b2840e42526d1ca151ca641931ca8e55503c1 Mon Sep 17 00:00:00 2001 From: Leo Sandoval Date: Tue, 27 May 2025 17:28:32 -0600 Subject: [PATCH 08/10] Handle special kernel parameter characters properly Resolves: #2362821 Signed-off-by: Leo Sandoval --- ...pe-kernel-option-characters-properly.patch | 47 +++++++++++++++++++ ...variable-is-escaped-before-consideri.patch | 26 ++++++++++ grub.patches | 2 + grub2.spec | 6 ++- 4 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 0359-10_linux.in-escape-kernel-option-characters-properly.patch create mode 100644 0360-blscfg-check-if-variable-is-escaped-before-consideri.patch diff --git a/0359-10_linux.in-escape-kernel-option-characters-properly.patch b/0359-10_linux.in-escape-kernel-option-characters-properly.patch new file mode 100644 index 00000000..fe245e8e --- /dev/null +++ b/0359-10_linux.in-escape-kernel-option-characters-properly.patch @@ -0,0 +1,47 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 7 May 2025 13:23:37 -0600 +Subject: [PATCH] 10_linux.in: escape kernel option characters properly + +This handles cases where kernel options, specifically the values, +contain special characters, in this case ';', '&' and '$'. + +For example, the user defines the following GRUB_CMDLINE_LINUX on the +default grub file /etc/default/grub, note the dolar sign on the 'memmap' +option + + GRUB_CMDLINE_LINUX="console=ttyS0 memmap=32g\\\$0x2000000000" + +then regenerating the grub cfg and BLS options line with the +grub2-mkconfig command, resulting into + + options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro + rootflags=subvol=root console=ttyS0 memmap=32g\$0x2000000000 + +without this patch, we would end up with + + options root=UUID=6baedf23-2510-499a-815d-48b58cf6e619 ro + rootflags=subvol=root console=ttyS0 memmap=32g$0x2000000000 + +Note the missing '\' which is required to escape the '$', otherwise +it would be consider a variable by blscfg parser which is not the case. + +Signed-off-by: Leo Sandoval +--- + util/grub.d/10_linux.in | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in +index 11c19304f8..cdfb72a1e3 100644 +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -178,6 +178,9 @@ update_bls_cmdline() + options="${options} ${GRUB_CMDLINE_LINUX_DEBUG}" + fi + options="$(echo "${options}" | sed -e 's/\//\\\//g')" ++ options="$(echo "${options}" | sed -e 's/\;/\\\;/g')" ++ options="$(echo "${options}" | sed -e 's/\\&/\\\\&/g')" ++ options="$(echo "${options}" | sed -e 's/\$/\\\$/g')" + sed -i -e "s/^options.*/options ${options}/" "${blsdir}/${bls}.conf" + done + } diff --git a/0360-blscfg-check-if-variable-is-escaped-before-consideri.patch b/0360-blscfg-check-if-variable-is-escaped-before-consideri.patch new file mode 100644 index 00000000..fba69064 --- /dev/null +++ b/0360-blscfg-check-if-variable-is-escaped-before-consideri.patch @@ -0,0 +1,26 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 7 May 2025 13:49:47 -0600 +Subject: [PATCH] blscfg: check if variable is escaped before considering one + +Otherwise escaped variables are considered real variables. + +Signed-off-by: Leo Sandoval +--- + grub-core/commands/blscfg.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/grub-core/commands/blscfg.c b/grub-core/commands/blscfg.c +index 6e398fc175..5d931b0c9b 100644 +--- a/grub-core/commands/blscfg.c ++++ b/grub-core/commands/blscfg.c +@@ -695,7 +695,8 @@ static char *expand_val(const char *value) + return NULL; + + while (*value) { +- if (*value == '$') { ++ /* It's a variable only when *value is '$' and it is not escaped with '\'*/ ++ if (*value == '$' && *end != '\\') { + if (start != end) { + buffer = field_append(is_var, buffer, start, end); + if (!buffer) diff --git a/grub.patches b/grub.patches index 2a52ab1f..3f991455 100644 --- a/grub.patches +++ b/grub.patches @@ -355,3 +355,5 @@ Patch0355: 0355-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch Patch0356: 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch Patch0357: 0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch Patch0358: 0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch +Patch0359: 0359-10_linux.in-escape-kernel-option-characters-properly.patch +Patch0360: 0360-blscfg-check-if-variable-is-escaped-before-consideri.patch \ No newline at end of file diff --git a/grub2.spec b/grub2.spec index e5430fea..4b421263 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 22%{?dist} +Release: 23%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,10 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Tue May 27 2025 Leo Sandoval 2.12-23 +- Handle special kernel parameter characters properly +- Resolves: #2362821 + * Mon May 19 2025 Nicolas Frayer 2.12-22 - sbat: bump grub sbat From 09bf4d360ef93c2884b24f085ddb358735c4ea6b Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Wed, 28 May 2025 19:40:21 +0200 Subject: [PATCH 09/10] Some fixes addressing memory freeing and dereferencing Resolves: #2368939 Resolves: #2368945 Signed-off-by: Nicolas Frayer --- ...ader-efi-chainloader-Fix-double-free.patch | 25 +++++++++++++++ ...nloader-Fix-null-pointer-dereference.patch | 31 +++++++++++++++++++ grub.patches | 4 ++- grub2.spec | 7 ++++- 4 files changed, 65 insertions(+), 2 deletions(-) create mode 100644 0361-loader-efi-chainloader-Fix-double-free.patch create mode 100644 0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch diff --git a/0361-loader-efi-chainloader-Fix-double-free.patch b/0361-loader-efi-chainloader-Fix-double-free.patch new file mode 100644 index 00000000..ae51483b --- /dev/null +++ b/0361-loader-efi-chainloader-Fix-double-free.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Thomas Frauendorfer | Miray Software +Date: Wed, 21 May 2025 10:56:19 +0200 +Subject: [PATCH] loader/efi/chainloader: Fix double free + +Signed-off-by: Thomas Frauendorfer | Miray Software +Reviewed-by: Nicolas Frayer +--- + grub-core/loader/efi/chainloader.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 7652f5a..0a78d0d 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -1193,9 +1193,6 @@ fail: + if (address) + grub_efi_free_pages (address, pages); + +- if (cmdline) +- grub_free (cmdline); +- + if (image_handle != NULL) + grub_efi_unload_image (image_handle); + diff --git a/0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch b/0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch new file mode 100644 index 00000000..1a5048ab --- /dev/null +++ b/0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch @@ -0,0 +1,31 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Thomas Frauendorfer | Miray Software +Date: Tue, 20 May 2025 09:20:46 +0200 +Subject: [PATCH] loader/efi/chainloader: Fix null pointer dereference + +This fixes a null pointer access during netboot +introduced in +* Allow chainloading EFI apps from loop mounts. + +The commit accesses dev->disk without testing it. +But when booting through network dev->disk will be NULL + +Signed-off-by: Thomas Frauendorfer | Miray Software +Reviewed-by: Nicolas Frayer +--- + grub-core/loader/efi/chainloader.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c +index 0a78d0d..a004020 100644 +--- a/grub-core/loader/efi/chainloader.c ++++ b/grub-core/loader/efi/chainloader.c +@@ -1006,7 +1006,7 @@ grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), + grub_free (devname); + + /* if device is loopback, use underlying dev */ +- if (dev && dev->disk->dev->id == GRUB_DISK_DEVICE_LOOPBACK_ID) ++ if (dev && dev->disk && dev->disk->dev->id == GRUB_DISK_DEVICE_LOOPBACK_ID) + { + struct grub_loopback *d; + orig_dev = dev; diff --git a/grub.patches b/grub.patches index 3f991455..fb814ebc 100644 --- a/grub.patches +++ b/grub.patches @@ -356,4 +356,6 @@ Patch0356: 0356-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch Patch0357: 0357-fs-ext2-Rework-out-of-bounds-read-for-inline-and-ext.patch Patch0358: 0358-ieee1275-ofnet-Fix-grub_malloc-removed-after-added-s.patch Patch0359: 0359-10_linux.in-escape-kernel-option-characters-properly.patch -Patch0360: 0360-blscfg-check-if-variable-is-escaped-before-consideri.patch \ No newline at end of file +Patch0360: 0360-blscfg-check-if-variable-is-escaped-before-consideri.patch +Patch0361: 0361-loader-efi-chainloader-Fix-double-free.patch +Patch0362: 0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch diff --git a/grub2.spec b/grub2.spec index 4b421263..45d83efd 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 23%{?dist} +Release: 24%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,11 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Wed May 28 2025 Nicolas Frayer - 2.12-24 +- Some fixes addressing memory freeing and dereferencing +- Resolves: #2368939 +- Resolves: #2368945 + * Tue May 27 2025 Leo Sandoval 2.12-23 - Handle special kernel parameter characters properly - Resolves: #2362821 From 6b935e7021e5d56dfebf705af72c34cc0763c988 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 17 Jun 2025 17:53:22 +0200 Subject: [PATCH 10/10] osdep/linux/getroot: Detect DDF container similar to IMSM Signed-off-by: Nicolas Frayer --- ...oot-Detect-DDF-container-similar-to-.patch | 86 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 5 +- 3 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch diff --git a/0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch b/0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch new file mode 100644 index 00000000..04e038e9 --- /dev/null +++ b/0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch @@ -0,0 +1,86 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Renaud=20M=C3=A9trich?= +Date: Thu, 24 Apr 2025 11:43:28 +0200 +Subject: [PATCH] osdep/linux/getroot: Detect DDF container similar to IMSM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Similarly to Intel IMSM, there are BIOS and UEFI implementations that +support DDF containers natively. + +DDF and IMSM are very similar in handling, especially these should not +be considered as RAID abstraction. This fixes the requirement of having +a device map when probing DDF containers. + +Fixes: https://issues.redhat.com/browse/RHEL-44336 + +Signed-off-by: Renaud Métrich +Reviewed-by: Daniel Kiper +--- + grub-core/osdep/linux/getroot.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/grub-core/osdep/linux/getroot.c b/grub-core/osdep/linux/getroot.c +index 527d4f0c538a..7872a8d03a0b 100644 +--- a/grub-core/osdep/linux/getroot.c ++++ b/grub-core/osdep/linux/getroot.c +@@ -119,7 +119,7 @@ struct btrfs_ioctl_search_args { + struct btrfs_ioctl_fs_info_args) + + static int +-grub_util_is_imsm (const char *os_dev); ++grub_util_is_imsm_or_ddf (const char *os_dev); + + + #define ESCAPED_PATH_MAX (4 * PATH_MAX) +@@ -638,10 +638,10 @@ out: + } + + static int +-grub_util_is_imsm (const char *os_dev) ++grub_util_is_imsm_or_ddf (const char *os_dev) + { + int retry; +- int is_imsm = 0; ++ int is_imsm_or_ddf = 0; + int container_seen = 0; + const char *dev = os_dev; + +@@ -702,10 +702,17 @@ grub_util_is_imsm (const char *os_dev) + if (strncmp (buf, "MD_METADATA=imsm", + sizeof ("MD_METADATA=imsm") - 1) == 0) + { +- is_imsm = 1; ++ is_imsm_or_ddf = 1; + grub_util_info ("%s is imsm", dev); + break; + } ++ if (strncmp (buf, "MD_METADATA=ddf", ++ sizeof ("MD_METADATA=ddf") - 1) == 0) ++ { ++ is_imsm_or_ddf = 1; ++ grub_util_info ("%s is ddf", dev); ++ break; ++ } + } + + free (buf); +@@ -716,7 +723,7 @@ grub_util_is_imsm (const char *os_dev) + + if (dev != os_dev) + free ((void *) dev); +- return is_imsm; ++ return is_imsm_or_ddf; + } + + char * +@@ -1081,7 +1088,7 @@ grub_util_get_dev_abstraction_os (const char *os_dev) + + /* Check for RAID. */ + if (!strncmp (os_dev, "/dev/md", 7) && ! grub_util_device_is_mapped (os_dev) +- && !grub_util_is_imsm (os_dev)) ++ && !grub_util_is_imsm_or_ddf (os_dev)) + return GRUB_DEV_ABSTRACTION_RAID; + return GRUB_DEV_ABSTRACTION_NONE; + } diff --git a/grub.patches b/grub.patches index fb814ebc..6c7d2bde 100644 --- a/grub.patches +++ b/grub.patches @@ -359,3 +359,4 @@ Patch0359: 0359-10_linux.in-escape-kernel-option-characters-properly.patch Patch0360: 0360-blscfg-check-if-variable-is-escaped-before-consideri.patch Patch0361: 0361-loader-efi-chainloader-Fix-double-free.patch Patch0362: 0362-loader-efi-chainloader-Fix-null-pointer-dereference.patch +Patch0363: 0363-osdep-linux-getroot-Detect-DDF-container-similar-to-.patch diff --git a/grub2.spec b/grub2.spec index 45d83efd..0509f659 100644 --- a/grub2.spec +++ b/grub2.spec @@ -17,7 +17,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 24%{?dist} +Release: 25%{?dist} Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later URL: http://www.gnu.org/software/grub/ @@ -602,6 +602,9 @@ mv ${EFI_HOME}/grub.cfg.stb ${EFI_HOME}/grub.cfg %endif %changelog +* Tue Jun 17 2025 Nicolas Frayer - 2.12-25 +- osdep/linux/getroot: Detect DDF container similar to IMSM + * Wed May 28 2025 Nicolas Frayer - 2.12-24 - Some fixes addressing memory freeing and dereferencing - Resolves: #2368939