mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
ded3e0045a
This patch brings the entire stack of Debian patches on grub2 titled "cve-2025-jan" and available at: https://salsa.debian.org/grub-team/grub/-/tree/debian/2.12-9/debian/patches/cve-2025-jan?ref_type=tags As of this exact Debian grub2 version 2.12-9. Some minor conflicts had to be fixed. All patches are in upstream Grub master, but mixed with hundreds of other changes, which is why Debian's effort to backport them has been leveraged here. In addition to those patches, 2 extra patches are added: 0073-net-drivers-ieee1275-ofnet-Add-missing-grub_malloc.patch 0074-Constant-time-grub_crypto_memcmp.patch The first one fixes an issue in one of the earlier patches. The fix is not in Debian, but is in upstream Grub. The second one fixes another CVE, not fixed in Debian, but fixed in OpenSUSE. This fix is not upstream as upstream has decided to move to libgcrypt instead to avoid the problem, but that's a fairly large change. Overall, this patch fixes all CVEs currently reported by pkg-stats against our grub2 package, namely: CVE-2024-45777 CVE-2024-45778 CVE-2024-45779 CVE-2024-45780 CVE-2024-45782 CVE-2024-56737 CVE-2024-56738 CVE-2025-0678 CVE-2025-0684 CVE-2025-0685 CVE-2025-0686 CVE-2025-0689 CVE-2025-1125 With the previous fixes on runtime tests added (to use glibc toolchains to build grub2 tests), this commit successfully passes all tests: - The ISO9660 tests that use grub2: https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234563 - The grub2 tests: https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234685 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [Julien: also tested by building and booting - qemu_aarch64_sbsa_defconfig - qemu_arm_ebbr_defconfig - qemu_loongarch64_virt_efi_defconfig - qemu_riscv64_virt_efi_defconfig - pc_x86_64_bios_defconfig - pc_x86_64_efi_defconfig ] Tested-by: Julien Olivain <ju.o@free.fr> [Julien: - fix patch #72 upstream link to point to the initial patch sumbission rather than a reply - merge two _IGNORE_CVES blocks for patch #50 into a single one - order _IGNORE_CVES blocks by numerical patch order - order numerically the CVE list in commit log - add a "Fixes:" tag in patch #74 since its commit log does not mention the CVE. ] Signed-off-by: Julien Olivain <ju.o@free.fr>
69 lines
2.4 KiB
Diff
69 lines
2.4 KiB
Diff
From b01accc4d132a252f02bf57c31f5fff8ce98a339 Mon Sep 17 00:00:00 2001
|
|
From: Lidong Chen <lidong.chen@oracle.com>
|
|
Date: Fri, 22 Nov 2024 06:27:59 +0000
|
|
Subject: [PATCH] fs/jfs: Fix OOB read in jfs_getent()
|
|
|
|
The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash
|
|
was caused by an invalid leaf nodes count, diro->dirpage->header.count,
|
|
which was larger than the maximum number of leaf nodes allowed in an
|
|
inode. This fix is to ensure that the leaf nodes count is validated in
|
|
grub_jfs_opendir() before calling grub_jfs_getent().
|
|
|
|
On the occasion replace existing raw numbers with newly defined constant.
|
|
|
|
Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
|
|
Upstream: 66175696f3a385b14bdf1ebcda7755834bd2d5fb
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
|
|
---
|
|
grub-core/fs/jfs.c | 17 +++++++++++++++--
|
|
1 file changed, 15 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
|
|
index 6f7c43904..32dec7fb7 100644
|
|
--- a/grub-core/fs/jfs.c
|
|
+++ b/grub-core/fs/jfs.c
|
|
@@ -41,6 +41,12 @@ GRUB_MOD_LICENSE ("GPLv3+");
|
|
|
|
#define GRUB_JFS_TREE_LEAF 2
|
|
|
|
+/*
|
|
+ * Define max entries stored in-line in an inode.
|
|
+ * https://jfs.sourceforge.net/project/pub/jfslayout.pdf
|
|
+ */
|
|
+#define GRUB_JFS_INODE_INLINE_ENTRIES 8
|
|
+
|
|
struct grub_jfs_sblock
|
|
{
|
|
/* The magic for JFS. It should contain the string "JFS1". */
|
|
@@ -203,9 +209,9 @@ struct grub_jfs_inode
|
|
grub_uint8_t freecnt;
|
|
grub_uint8_t freelist;
|
|
grub_uint32_t idotdot;
|
|
- grub_uint8_t sorted[8];
|
|
+ grub_uint8_t sorted[GRUB_JFS_INODE_INLINE_ENTRIES];
|
|
} header;
|
|
- struct grub_jfs_leaf_dirent dirents[8];
|
|
+ struct grub_jfs_leaf_dirent dirents[GRUB_JFS_INODE_INLINE_ENTRIES];
|
|
} GRUB_PACKED dir;
|
|
/* Fast symlink. */
|
|
struct
|
|
@@ -453,6 +459,13 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode)
|
|
/* Check if the entire tree is contained within the inode. */
|
|
if (inode->file.tree.flags & GRUB_JFS_TREE_LEAF)
|
|
{
|
|
+ if (inode->dir.header.count > GRUB_JFS_INODE_INLINE_ENTRIES)
|
|
+ {
|
|
+ grub_free (diro);
|
|
+ grub_error (GRUB_ERR_BAD_FS, N_("invalid JFS inode"));
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
diro->leaf = inode->dir.dirents;
|
|
diro->next_leaf = (struct grub_jfs_leaf_next_dirent *) de;
|
|
diro->sorted = inode->dir.header.sorted;
|
|
--
|
|
2.50.1
|
|
|