Skip to content

Commit bd7959a

Browse files
akhila-gurujuakhila-guruju
authored
[Medium] Patch grub2 for CVE-2025-61661, CVE-2025-61662 & CVE-2025-61663 (#15172)
1 parent f44d988 commit bd7959a

5 files changed

Lines changed: 173 additions & 2 deletions

File tree

‎SPECS-SIGNED/grub2-efi-binary-signed/grub2-efi-binary-signed.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
Summary: Signed GRand Unified Bootloader for %{buildarch} systems
1313
Name: grub2-efi-binary-signed-%{buildarch}
1414
Version: 2.06
15-
Release: 15%{?dist}
15+
Release: 16%{?dist}
1616
License: GPLv3+
1717
Vendor: Microsoft Corporation
1818
Distribution: Mariner
@@ -77,6 +77,9 @@ cp %{SOURCE3} %{buildroot}/boot/efi/EFI/BOOT/%{grubpxeefiname}
7777
/boot/efi/EFI/BOOT/%{grubpxeefiname}
7878

7979
%changelog
80+
* Thu Nov 27 2025 Akhila Guruju <v-guakhila@microsoft.com> - 2.06-16
81+
- Bump release number to match grub release
82+
8083
* Tue Jun 17 2025 Kshitiz Godara <kgodara@microsoft.com> - 2.06-15
8184
- Bump release number to match grub release
8285

‎SPECS/grub2/CVE-2025-61661.patch‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
From 549a9cc372fd0b96a4ccdfad0e12140476cc62a3 Mon Sep 17 00:00:00 2001
2+
From: Jamie <volticks@gmail.com>
3+
Date: Mon, 14 Jul 2025 09:52:59 +0100
4+
Subject: [PATCH] commands/usbtest: Use correct string length field
5+
6+
An incorrect length field is used for buffer allocation. This leads to
7+
grub_utf16_to_utf8() receiving an incorrect/different length and possibly
8+
causing OOB write. This makes sure to use the correct length.
9+
10+
Fixes: CVE-2025-61661
11+
12+
Reported-by: Jamie <volticks@gmail.com>
13+
Signed-off-by: Jamie <volticks@gmail.com>
14+
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15+
16+
Upstream Patch Reference: https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=patch;h=549a9cc372fd0b96a4ccdfad0e12140476cc62a3
17+
---
18+
grub-core/commands/usbtest.c | 2 +-
19+
1 file changed, 1 insertion(+), 1 deletion(-)
20+
21+
diff --git a/grub-core/commands/usbtest.c b/grub-core/commands/usbtest.c
22+
index 2c6d93fe6..8ef187a9a 100644
23+
--- a/grub-core/commands/usbtest.c
24+
+++ b/grub-core/commands/usbtest.c
25+
@@ -99,7 +99,7 @@ grub_usb_get_string (grub_usb_device_t dev, grub_uint8_t index, int langid,
26+
return GRUB_USB_ERR_NONE;
27+
}
28+
29+
- *string = grub_malloc (descstr.length * 2 + 1);
30+
+ *string = grub_malloc (descstrp->length * 2 + 1);
31+
if (! *string)
32+
{
33+
grub_free (descstrp);
34+
--
35+
2.39.5

‎SPECS/grub2/CVE-2025-61662.patch‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
From 8ed78fd9f0852ab218cc1f991c38e5a229e43807 Mon Sep 17 00:00:00 2001
2+
From: Alec Brown <alec.r.brown@oracle.com>
3+
Date: Thu, 21 Aug 2025 21:14:06 +0000
4+
Subject: [PATCH] gettext/gettext: Unregister gettext command on module unload
5+
6+
When the gettext module is loaded, the gettext command is registered but
7+
isn't unregistered when the module is unloaded. We need to add a call to
8+
grub_unregister_command() when unloading the module.
9+
10+
Fixes: CVE-2025-61662
11+
12+
Reported-by: Alec Brown <alec.r.brown@oracle.com>
13+
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
14+
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15+
16+
Upstream Patch Reference: https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=patch;h=8ed78fd9f0852ab218cc1f991c38e5a229e43807
17+
---
18+
grub-core/gettext/gettext.c | 19 ++++++++++++-------
19+
1 file changed, 12 insertions(+), 7 deletions(-)
20+
21+
diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
22+
index 4d02e62..47509c3 100644
23+
--- a/grub-core/gettext/gettext.c
24+
+++ b/grub-core/gettext/gettext.c
25+
@@ -497,6 +497,8 @@ grub_cmd_translate (grub_command_t cmd __attribute__ ((unused)),
26+
return 0;
27+
}
28+
29+
+static grub_command_t cmd;
30+
+
31+
GRUB_MOD_INIT (gettext)
32+
{
33+
const char *lang;
34+
@@ -516,13 +518,14 @@ GRUB_MOD_INIT (gettext)
35+
grub_register_variable_hook ("locale_dir", NULL, read_main);
36+
grub_register_variable_hook ("secondary_locale_dir", NULL, read_secondary);
37+
38+
- grub_register_command_p1 ("gettext", grub_cmd_translate,
39+
- N_("STRING"),
40+
- /* TRANSLATORS: It refers to passing the string through gettext.
41+
- So it's "translate" in the same meaning as in what you're
42+
- doing now.
43+
- */
44+
- N_("Translates the string with the current settings."));
45+
+ cmd = grub_register_command_p1 ("gettext", grub_cmd_translate,
46+
+ N_("STRING"),
47+
+ /*
48+
+ * TRANSLATORS: It refers to passing the string through gettext.
49+
+ * So it's "translate" in the same meaning as in what you're
50+
+ * doing now.
51+
+ */
52+
+ N_("Translates the string with the current settings."));
53+
54+
/* Reload .mo file information if lang changes. */
55+
grub_register_variable_hook ("lang", NULL, grub_gettext_env_write_lang);
56+
@@ -535,6 +538,8 @@ GRUB_MOD_INIT (gettext)
57+
58+
GRUB_MOD_FINI (gettext)
59+
{
60+
+ grub_unregister_command (cmd);
61+
+
62+
grub_gettext_delete_list (&main_context);
63+
grub_gettext_delete_list (&secondary_context);
64+
65+
--
66+
2.43.0
67+

‎SPECS/grub2/CVE-2025-61663.patch‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
From 05d3698b8b03eccc49e53491bbd75dba15f40917 Mon Sep 17 00:00:00 2001
2+
From: Alec Brown <alec.r.brown@oracle.com>
3+
Date: Thu, 21 Aug 2025 21:14:07 +0000
4+
Subject: [PATCH] normal/main: Unregister commands on module unload
5+
6+
When the normal module is loaded, the normal and normal_exit commands
7+
are registered but aren't unregistered when the module is unloaded. We
8+
need to add calls to grub_unregister_command() when unloading the module
9+
for these commands.
10+
11+
Fixes: CVE-2025-61663
12+
Fixes: CVE-2025-61664
13+
14+
Reported-by: Alec Brown <alec.r.brown@oracle.com>
15+
Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
16+
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17+
18+
Upstream Patch Reference: https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=patch;h=05d3698b8b03eccc49e53491bbd75dba15f40917
19+
---
20+
grub-core/normal/main.c | 12 +++++++-----
21+
1 file changed, 7 insertions(+), 5 deletions(-)
22+
23+
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
24+
index c4ebe9e..65fa95b 100644
25+
--- a/grub-core/normal/main.c
26+
+++ b/grub-core/normal/main.c
27+
@@ -499,7 +499,7 @@ grub_mini_cmd_clear (struct grub_command *cmd __attribute__ ((unused)),
28+
return 0;
29+
}
30+
31+
-static grub_command_t cmd_clear;
32+
+static grub_command_t cmd_clear, cmd_normal, cmd_normal_exit;
33+
34+
static void (*grub_xputs_saved) (const char *str);
35+
static const char *features[] = {
36+
@@ -541,10 +541,10 @@ GRUB_MOD_INIT(normal)
37+
grub_env_export ("pager");
38+
39+
/* Register a command "normal" for the rescue mode. */
40+
- grub_register_command ("normal", grub_cmd_normal,
41+
- 0, N_("Enter normal mode."));
42+
- grub_register_command ("normal_exit", grub_cmd_normal_exit,
43+
- 0, N_("Exit from normal mode."));
44+
+ cmd_normal = grub_register_command ("normal", grub_cmd_normal,
45+
+ 0, N_("Enter normal mode."));
46+
+ cmd_normal_exit = grub_register_command ("normal_exit", grub_cmd_normal_exit,
47+
+ 0, N_("Exit from normal mode."));
48+
49+
/* Reload terminal colors when these variables are written to. */
50+
grub_register_variable_hook ("color_normal", NULL, grub_env_write_color_normal);
51+
@@ -584,4 +584,6 @@ GRUB_MOD_FINI(normal)
52+
grub_register_variable_hook ("pager", 0, 0);
53+
grub_fs_autoload_hook = 0;
54+
grub_unregister_command (cmd_clear);
55+
+ grub_unregister_command (cmd_normal);
56+
+ grub_unregister_command (cmd_normal_exit);
57+
}
58+
--
59+
2.43.0
60+

‎SPECS/grub2/grub2.spec‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: GRand Unified Bootloader
77
Name: grub2
88
Version: 2.06
9-
Release: 15%{?dist}
9+
Release: 16%{?dist}
1010
License: GPLv3+
1111
Vendor: Microsoft Corporation
1212
Distribution: Mariner
@@ -122,6 +122,9 @@ Patch: CVE-2025-0690.patch
122122
Patch: CVE-2024-45778.patch
123123
Patch: CVE-2025-0678.patch
124124
Patch: CVE-2024-45780.patch
125+
Patch: CVE-2025-61661.patch
126+
Patch: CVE-2025-61662.patch
127+
Patch: CVE-2025-61663.patch
125128
# Following are included as part of above CVEs and kept here as nopatch
126129
# and commented out, because from patch command perspective, these files
127130
# have garbage content.
@@ -435,6 +438,9 @@ cp $GRUB_PXE_MODULE_SOURCE $EFI_BOOT_DIR/$GRUB_PXE_MODULE_NAME
435438
%{_sysconfdir}/default/grub.d
436439

437440
%changelog
441+
* Thu Nov 27 2025 Akhila Guruju <v-guakhila@microsoft.com> - 2.06-16
442+
- patch CVE-2025-61661, CVE-2025-61662 & CVE-2025-61663
443+
438444
* Tue Jun 17 2025 Kshitiz Godara <kgodara@microsoft.com> - 2.06-15
439445
- Addressed following grub2 CVEs
440446
- CVE-2025-0684

0 commit comments

Comments
 (0)