[SECURITY PATCH 055/117] loader/xnu: Free driverkey data when an error is detected in grub_xnu_writetree_toheap()

From: Marco A Benatto ... to avoid memory leaks. Fixes: CID 96640 Signed-off-by: Marco A Benatto Reviewed-by: Daniel Kiper --- grub-core/loader/xnu.c | 24 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/grub-core/loader/xnu.c b/grub-core/loader/xnu.c

[SECURITY PATCH 026/117] gnulib/regexec: Fix possible null-dereference

From: Darren Kenny It appears to be possible that the mctx->state_log field may be NULL, and the name of this function, clean_state_log_if_needed(), suggests that it should be checking that it is valid to be cleaned before assuming that it does. Fixes: CID 86720 Signed-off-by: Darren Kenny

[SECURITY PATCH 015/117] dl: Only allow unloading modules that are not dependencies

From: Javier Martinez Canillas When a module is attempted to be removed its reference counter is always decremented. This means that repeated rmmod invocations will cause the module to be unloaded even if another module depends on it. This may lead to a use-after-free scenario allowing an

[SECURITY PATCH 049/117] video/fb/video_fb: Fix multiple integer overflows

From: Darren Kenny The calculation of the unsigned 64-bit value is being generated by multiplying 2, signed or unsigned, 32-bit integers which may overflow before promotion to unsigned 64-bit. Fix all of them. Fixes: CID 73703, CID 73767, CID 73833 Signed-off-by: Darren Kenny Reviewed-by:

[SECURITY PATCH 011/117] commands/hdparm: Restrict hdparm command when locked down

From: Javier Martinez Canillas The command can be used to get/set ATA disk parameters. Some of these can be dangerous since change the disk behavior. Restrict it when locked down. Signed-off-by: Javier Martinez Canillas Reviewed-by: Daniel Kiper --- grub-core/commands/hdparm.c | 6 +++--- 1

[SECURITY PATCH 048/117] video/fb/fbfill: Fix potential integer overflow

From: Darren Kenny The multiplication of 2 unsigned 32-bit integers may overflow before promotion to unsigned 64-bit. We should ensure that the multiplication is done with overflow detection. Additionally, use grub_sub() for subtraction. Fixes: CID 73640, CID 73697, CID 73702, CID 73823

[SECURITY PATCH 009/117] commands: Restrict commands that can load BIOS or DT blobs when locked down

From: Javier Martinez Canillas There are some more commands that should be restricted when the GRUB is locked down. Following is the list of commands and reasons to restrict: * fakebios: creates BIOS-like structures for backward compatibility with existing OSes. This should

[SECURITY PATCH 025/117] gnulib/argp-help: Fix dereference of a possibly NULL state

From: Darren Kenny All other instances of call to __argp_failure() where there is a dgettext() call is first checking whether state is NULL before attempting to dereference it to get the root_argp->argp_domain. Fixes: CID 292436 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper ---

[SECURITY PATCH 045/117] commands/hashsum: Fix a memory leak

From: Chris Coulson check_list() uses grub_file_getline(), which allocates a buffer. If the hash list file contains invalid lines, the function leaks this buffer when it returns an error. Fixes: CID 176635 Signed-off-by: Chris Coulson Reviewed-by: Daniel Kiper ---

[SECURITY PATCH 022/117] kern/efi/mm: Fix possible NULL pointer dereference

From: Darren Kenny The model of grub_efi_get_memory_map() is that if memory_map is NULL, then the purpose is to discover how much memory should be allocated to it for the subsequent call. The problem here is that with grub_efi_is_finished set to 1, there is no check at all that the function is

[SECURITY PATCH 043/117] syslinux: Fix memory leak while parsing

From: Darren Kenny In syslinux_parse_real() the 2 points where return is being called didn't release the memory stored in buf which is no longer required. Fixes: CID 176634 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper --- grub-core/lib/syslinux_parse.c | 6 +- 1 file changed, 5

[SECURITY PATCH 006/117] efi: Use grub_is_lockdown() instead of hardcoding a disabled modules list

From: Javier Martinez Canillas Now the GRUB can check if it has been locked down and this can be used to prevent executing commands that can be utilized to circumvent the UEFI Secure Boot mechanisms. So, instead of hardcoding a list of modules that have to be disabled, prevent the usage of

[SECURITY PATCH 024/117] gnulib/regcomp: Fix uninitialized token structure

From: Darren Kenny The code is assuming that the value of br_token.constraint was initialized to zero when it wasn't. While some compilers will ensure that, not all do, so it is better to fix this explicitly than leave it to chance. Fixes: CID 73749 Signed-off-by: Darren Kenny Reviewed-by:

[SECURITY PATCH 007/117] acpi: Don't register the acpi command when locked down

From: Javier Martinez Canillas The command is not allowed when lockdown is enforced. Otherwise an attacker can instruct the GRUB to load an SSDT table to overwrite the kernel lockdown configuration and later load and execute unsigned code. Fixes: CVE-2020-14372 Reported-by: Máté Kukri

[SECURITY PATCH 036/117] zfs: Fix possible negative shift operation

From: Darren Kenny While it is possible for the return value from zfs_log2() to be zero (0), it is quite unlikely, given that the previous assignment to blksz is shifted up by SPA_MINBLOCKSHIFT (9) before 9 is subtracted at the assignment to epbs. But, while unlikely during a normal operation,

[SECURITY PATCH 018/117] net/net: Fix possible dereference to of a NULL pointer

From: Darren Kenny It is always possible that grub_zalloc() could fail, so we should check for a NULL return. Otherwise we run the risk of dereferencing a NULL pointer. Fixes: CID 296221 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper --- grub-core/net/net.c | 9 +++-- 1 file

[SECURITY PATCH 032/117] disk/ldm: If failed then free vg variable too

From: Paulo Flabiano Smorigo Fixes: CID 73809 Signed-off-by: Paulo Flabiano Smorigo Reviewed-by: Daniel Kiper --- grub-core/disk/ldm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/grub-core/disk/ldm.c b/grub-core/disk/ldm.c index 48942549a..c25941ec9 100644 --- a/grub-core/disk/ldm.c

[SECURITY PATCH 020/117] kern/parser: Fix resource leak if argc == 0

From: Darren Kenny After processing the command-line yet arriving at the point where we are setting argv, we are allocating memory, even if argc == 0, which makes no sense since we never put anything into the allocated argv. The solution is to simply return that we've successfully processed the

[SECURITY PATCH 028/117] io/lzopio: Resolve unnecessary self-assignment errors

From: Darren Kenny These 2 assignments are unnecessary since they are just assigning to themselves. Fixes: CID 73643 Signed-off-by: Darren Kenny Reviewed-by: Daniel Kiper --- grub-core/io/lzopio.c | 4 1 file changed, 4 deletions(-) diff --git a/grub-core/io/lzopio.c

[SECURITY PATCH 029/117] zstd: Initialize seq_t structure fully

From: Darren Kenny While many compilers will initialize this to zero, not all will, so it is better to be sure that fields not being explicitly set are at known values, and there is code that checks this fields value elsewhere in the code. Fixes: CID 292440 Signed-off-by: Darren Kenny

[SECURITY PATCH 005/117] efi: Lockdown the GRUB when the UEFI Secure Boot is enabled

From: Javier Martinez Canillas If the UEFI Secure Boot is enabled then the GRUB must be locked down to prevent executing code that can potentially be used to subvert its verification mechanisms. Signed-off-by: Javier Martinez Canillas Reviewed-by: Daniel Kiper --- grub-core/kern/efi/init.c |

[SECURITY PATCH 016/117] usb: Avoid possible out-of-bound accesses caused by malicious devices

From: Javier Martinez Canillas The maximum number of configurations and interfaces are fixed but there is no out-of-bound checking to prevent a malicious USB device to report large values for these and cause accesses outside the arrays' memory. Fixes: CVE-2020-25647 Reported-by: Joseph Tartaro

[SECURITY PATCH 008/117] mmap: Don't register cutmem and badram commands when lockdown is enforced

From: Javier Martinez Canillas The cutmem and badram commands can be used to remove EFI memory regions and potentially disable the UEFI Secure Boot. Prevent the commands to be registered if the GRUB is locked down. Fixes: CVE-2020-27779 Reported-by: Teddy Reed Signed-off-by: Javier Martinez

[SECURITY PATCH 000/117] Multiple GRUB2 vulnerabilities - 2021/03/02 round

Hi all, The BootHole vulnerability [1][2] announced last year encouraged many people to take a closer look at the security of boot process in general and the GRUB bootloader in particular. Due to that, during past few months we were getting reports of, and also discovering various security flaws

<    1   2