mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
ded3e0045a
This patch brings the entire stack of Debian patches on grub2 titled "cve-2025-jan" and available at: https://salsa.debian.org/grub-team/grub/-/tree/debian/2.12-9/debian/patches/cve-2025-jan?ref_type=tags As of this exact Debian grub2 version 2.12-9. Some minor conflicts had to be fixed. All patches are in upstream Grub master, but mixed with hundreds of other changes, which is why Debian's effort to backport them has been leveraged here. In addition to those patches, 2 extra patches are added: 0073-net-drivers-ieee1275-ofnet-Add-missing-grub_malloc.patch 0074-Constant-time-grub_crypto_memcmp.patch The first one fixes an issue in one of the earlier patches. The fix is not in Debian, but is in upstream Grub. The second one fixes another CVE, not fixed in Debian, but fixed in OpenSUSE. This fix is not upstream as upstream has decided to move to libgcrypt instead to avoid the problem, but that's a fairly large change. Overall, this patch fixes all CVEs currently reported by pkg-stats against our grub2 package, namely: CVE-2024-45777 CVE-2024-45778 CVE-2024-45779 CVE-2024-45780 CVE-2024-45782 CVE-2024-56737 CVE-2024-56738 CVE-2025-0678 CVE-2025-0684 CVE-2025-0685 CVE-2025-0686 CVE-2025-0689 CVE-2025-1125 With the previous fixes on runtime tests added (to use glibc toolchains to build grub2 tests), this commit successfully passes all tests: - The ISO9660 tests that use grub2: https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234563 - The grub2 tests: https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234685 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [Julien: also tested by building and booting - qemu_aarch64_sbsa_defconfig - qemu_arm_ebbr_defconfig - qemu_loongarch64_virt_efi_defconfig - qemu_riscv64_virt_efi_defconfig - pc_x86_64_bios_defconfig - pc_x86_64_efi_defconfig ] Tested-by: Julien Olivain <ju.o@free.fr> [Julien: - fix patch #72 upstream link to point to the initial patch sumbission rather than a reply - merge two _IGNORE_CVES blocks for patch #50 into a single one - order _IGNORE_CVES blocks by numerical patch order - order numerically the CVE list in commit log - add a "Fixes:" tag in patch #74 since its commit log does not mention the CVE. ] Signed-off-by: Julien Olivain <ju.o@free.fr>
90 lines
3.0 KiB
Diff
90 lines
3.0 KiB
Diff
From 7ad4117be44d8cf0443bbc58d49e592a33aaac89 Mon Sep 17 00:00:00 2001
|
|
From: B Horn <b@horn.uk>
|
|
Date: Fri, 15 Nov 2024 13:12:09 +0000
|
|
Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file()
|
|
|
|
The function included a call to grub_strcpy() which copied data from an
|
|
environment variable to a buffer allocated in grub_cmd_normal(). The
|
|
grub_cmd_normal() didn't consider the length of the environment variable.
|
|
So, the copy operation could exceed the allocation and lead to an OOB
|
|
write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and
|
|
pass the underlying buffers size to the grub_net_search_config_file().
|
|
|
|
Fixes: CVE-2025-0624
|
|
|
|
Reported-by: B Horn <b@horn.uk>
|
|
Signed-off-by: B Horn <b@horn.uk>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
|
Conflicts:
|
|
grub-core/normal/main.c
|
|
|
|
Upstream: 5eef88152833062a3f7e017535372d64ac8ef7e1
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
|
|
---
|
|
grub-core/net/net.c | 7 ++++---
|
|
grub-core/normal/main.c | 2 +-
|
|
include/grub/net.h | 2 +-
|
|
3 files changed, 6 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/grub-core/net/net.c b/grub-core/net/net.c
|
|
index 8dbb0eada..2bd490279 100644
|
|
--- a/grub-core/net/net.c
|
|
+++ b/grub-core/net/net.c
|
|
@@ -1942,14 +1942,15 @@ grub_config_search_through (char *config, char *suffix,
|
|
}
|
|
|
|
grub_err_t
|
|
-grub_net_search_config_file (char *config)
|
|
+grub_net_search_config_file (char *config, grub_size_t config_buf_len)
|
|
{
|
|
- grub_size_t config_len;
|
|
+ grub_size_t config_len, suffix_len;
|
|
char *suffix;
|
|
|
|
config_len = grub_strlen (config);
|
|
config[config_len] = '-';
|
|
suffix = config + config_len + 1;
|
|
+ suffix_len = config_buf_len - (config_len + 1);
|
|
|
|
struct grub_net_network_level_interface *inf;
|
|
FOR_NET_NETWORK_LEVEL_INTERFACES (inf)
|
|
@@ -1975,7 +1976,7 @@ grub_net_search_config_file (char *config)
|
|
|
|
if (client_uuid)
|
|
{
|
|
- grub_strcpy (suffix, client_uuid);
|
|
+ grub_strlcpy (suffix, client_uuid, suffix_len);
|
|
if (grub_config_search_through (config, suffix, 1, 0) == 0)
|
|
return GRUB_ERR_NONE;
|
|
}
|
|
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
|
|
index bd4431000..3b48cd333 100644
|
|
--- a/grub-core/normal/main.c
|
|
+++ b/grub-core/normal/main.c
|
|
@@ -344,7 +344,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)),
|
|
|
|
if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 &&
|
|
!disable_net_search)
|
|
- grub_net_search_config_file (config);
|
|
+ grub_net_search_config_file (config, config_len);
|
|
|
|
grub_enter_normal_mode (config);
|
|
grub_free (config);
|
|
diff --git a/include/grub/net.h b/include/grub/net.h
|
|
index 228d04963..58a4f83fc 100644
|
|
--- a/include/grub/net.h
|
|
+++ b/include/grub/net.h
|
|
@@ -570,7 +570,7 @@ void
|
|
grub_net_remove_dns_server (const struct grub_net_network_level_address *s);
|
|
|
|
grub_err_t
|
|
-grub_net_search_config_file (char *config);
|
|
+grub_net_search_config_file (char *config, grub_size_t config_buf_len);
|
|
|
|
extern char *grub_net_default_server;
|
|
|
|
--
|
|
2.50.1
|
|
|