|
| 1 | +From 8ab67bb3b37cec634490294560d082bafda7cc66 Mon Sep 17 00:00:00 2001 |
| 2 | +From: jykanase <v-jykanase@microsoft.com> |
| 3 | +Date: Mon, 2 Jun 2025 07:47:48 +0000 |
| 4 | +Subject: [PATCH] CVE-2025-0624 |
| 5 | + |
| 6 | +Upstream Reference Patch: https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00052.html |
| 7 | +https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00027.html |
| 8 | +--- |
| 9 | + grub-core/net/net.c | 7 ++++--- |
| 10 | + grub-core/normal/main.c | 2 +- |
| 11 | + include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++ |
| 12 | + include/grub/net.h | 2 +- |
| 13 | + 4 files changed, 45 insertions(+), 5 deletions(-) |
| 14 | + |
| 15 | +diff --git a/grub-core/net/net.c b/grub-core/net/net.c |
| 16 | +index 4d3eb5c..ec7f01c 100644 |
| 17 | +--- a/grub-core/net/net.c |
| 18 | ++++ b/grub-core/net/net.c |
| 19 | +@@ -1773,14 +1773,15 @@ grub_config_search_through (char *config, char *suffix, |
| 20 | + } |
| 21 | + |
| 22 | + grub_err_t |
| 23 | +-grub_net_search_config_file (char *config) |
| 24 | ++grub_net_search_config_file (char *config, grub_size_t config_buf_len) |
| 25 | + { |
| 26 | +- grub_size_t config_len; |
| 27 | ++ grub_size_t config_len, suffix_len; |
| 28 | + char *suffix; |
| 29 | + |
| 30 | + config_len = grub_strlen (config); |
| 31 | + config[config_len] = '-'; |
| 32 | + suffix = config + config_len + 1; |
| 33 | ++ suffix_len = config_buf_len - (config_len + 1); |
| 34 | + |
| 35 | + struct grub_net_network_level_interface *inf; |
| 36 | + FOR_NET_NETWORK_LEVEL_INTERFACES (inf) |
| 37 | +@@ -1806,7 +1807,7 @@ grub_net_search_config_file (char *config) |
| 38 | + |
| 39 | + if (client_uuid) |
| 40 | + { |
| 41 | +- grub_strcpy (suffix, client_uuid); |
| 42 | ++ grub_strlcpy (suffix, client_uuid, suffix_len); |
| 43 | + if (grub_config_search_through (config, suffix, 1, 0) == 0) |
| 44 | + return GRUB_ERR_NONE; |
| 45 | + } |
| 46 | +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c |
| 47 | +index c4ebe9e..68ef09c 100644 |
| 48 | +--- a/grub-core/normal/main.c |
| 49 | ++++ b/grub-core/normal/main.c |
| 50 | +@@ -344,7 +344,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)), |
| 51 | + |
| 52 | + if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 && |
| 53 | + !disable_net_search) |
| 54 | +- grub_net_search_config_file (config); |
| 55 | ++ grub_net_search_config_file (config, config_len); |
| 56 | + |
| 57 | + grub_enter_normal_mode (config); |
| 58 | + grub_free (config); |
| 59 | +diff --git a/include/grub/misc.h b/include/grub/misc.h |
| 60 | +index 7d2b551..0507567 100644 |
| 61 | +--- a/include/grub/misc.h |
| 62 | ++++ b/include/grub/misc.h |
| 63 | +@@ -64,6 +64,45 @@ grub_stpcpy (char *dest, const char *src) |
| 64 | + return d - 1; |
| 65 | + } |
| 66 | + |
| 67 | ++static inline grub_size_t |
| 68 | ++grub_strlcpy (char *dest, const char *src, grub_size_t size) |
| 69 | ++{ |
| 70 | ++ char *d = dest; |
| 71 | ++ grub_size_t res = 0; |
| 72 | ++ /* |
| 73 | ++ * We do not subtract one from size here to avoid dealing with underflowing |
| 74 | ++ * the value, which is why to_copy is always checked to be greater than one |
| 75 | ++ * throughout this function. |
| 76 | ++ */ |
| 77 | ++ grub_size_t to_copy = size; |
| 78 | ++ |
| 79 | ++ /* Copy size - 1 bytes to dest. */ |
| 80 | ++ if (to_copy > 1) |
| 81 | ++ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1) |
| 82 | ++ ; |
| 83 | ++ |
| 84 | ++ /* |
| 85 | ++ * NUL terminate if size != 0. The previous step may have copied a NUL byte |
| 86 | ++ * if it reached the end of the string, but we know dest[size - 1] must always |
| 87 | ++ * be a NUL byte. |
| 88 | ++ */ |
| 89 | ++ if (size != 0) |
| 90 | ++ dest[size - 1] = '\0'; |
| 91 | ++ |
| 92 | ++ /* If there is still space in dest, but are here, we reached the end of src. */ |
| 93 | ++ if (to_copy > 1) |
| 94 | ++ return res; |
| 95 | ++ |
| 96 | ++ /* |
| 97 | ++ * If we haven't reached the end of the string, iterate through to determine |
| 98 | ++ * the strings total length. |
| 99 | ++ */ |
| 100 | ++ while (*src++ != '\0' && ++res) |
| 101 | ++ ; |
| 102 | ++ |
| 103 | ++ return res; |
| 104 | ++} |
| 105 | ++ |
| 106 | + /* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */ |
| 107 | + static inline void * |
| 108 | + grub_memcpy (void *dest, const void *src, grub_size_t n) |
| 109 | +diff --git a/include/grub/net.h b/include/grub/net.h |
| 110 | +index 7ae4b6b..d6ba8b1 100644 |
| 111 | +--- a/include/grub/net.h |
| 112 | ++++ b/include/grub/net.h |
| 113 | +@@ -570,7 +570,7 @@ void |
| 114 | + grub_net_remove_dns_server (const struct grub_net_network_level_address *s); |
| 115 | + |
| 116 | + grub_err_t |
| 117 | +-grub_net_search_config_file (char *config); |
| 118 | ++grub_net_search_config_file (char *config, grub_size_t config_buf_len); |
| 119 | + |
| 120 | + extern char *grub_net_default_server; |
| 121 | + |
| 122 | +-- |
| 123 | +2.45.2 |
| 124 | + |
0 commit comments