|
| 1 | +From 2123c5bca7e21fbeb0263df4597ddd7054700726 Mon Sep 17 00:00:00 2001 |
| 2 | +From: B Horn <b@horn.uk> |
| 3 | +Date: Fri, 1 Nov 2024 19:24:29 +0000 |
| 4 | +Subject: [PATCH 1/3] commands/pgp: Unregister the "check_signatures" hooks on |
| 5 | + module unload |
| 6 | + |
| 7 | +If the hooks are not removed they can be called after the module has |
| 8 | +been unloaded leading to an use-after-free. |
| 9 | + |
| 10 | +Fixes: CVE-2025-0622 |
| 11 | + |
| 12 | +Reported-by: B Horn <b@horn.uk> |
| 13 | +Signed-off-by: B Horn <b@horn.uk> |
| 14 | +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> |
| 15 | +--- |
| 16 | + grub-core/commands/pgp.c | 2 ++ |
| 17 | + 1 file changed, 2 insertions(+) |
| 18 | + |
| 19 | +diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c |
| 20 | +index c6766f044..5fadc33c4 100644 |
| 21 | +--- a/grub-core/commands/pgp.c |
| 22 | ++++ b/grub-core/commands/pgp.c |
| 23 | +@@ -1010,6 +1010,8 @@ GRUB_MOD_INIT(pgp) |
| 24 | + |
| 25 | + GRUB_MOD_FINI(pgp) |
| 26 | + { |
| 27 | ++ grub_register_variable_hook ("check_signatures", NULL, NULL); |
| 28 | ++ grub_env_unset ("check_signatures"); |
| 29 | + grub_verifier_unregister (&grub_pubkey_verifier); |
| 30 | + grub_unregister_extcmd (cmd); |
| 31 | + grub_unregister_extcmd (cmd_trust); |
| 32 | +-- |
| 33 | +2.45.4 |
| 34 | + |
| 35 | + |
| 36 | +From 9c16197734ada8d0838407eebe081117799bfe67 Mon Sep 17 00:00:00 2001 |
| 37 | +From: B Horn <b@horn.uk> |
| 38 | +Date: Fri, 1 Nov 2024 23:46:55 +0000 |
| 39 | +Subject: [PATCH 2/3] normal: Remove variables hooks on module unload |
| 40 | + |
| 41 | +The normal module does not entirely cleanup after itself in |
| 42 | +its GRUB_MOD_FINI() leaving a few variables hooks in place. |
| 43 | +It is not possible to unload normal module now but fix the |
| 44 | +issues for completeness. |
| 45 | + |
| 46 | +On the occasion replace 0s with NULLs for "pager" variable |
| 47 | +hooks unregister. |
| 48 | + |
| 49 | +Fixes: CVE-2025-0622 |
| 50 | + |
| 51 | +Reported-by: B Horn <b@horn.uk> |
| 52 | +Signed-off-by: B Horn <b@horn.uk> |
| 53 | +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> |
| 54 | +--- |
| 55 | + grub-core/normal/main.c | 4 +++- |
| 56 | + 1 file changed, 3 insertions(+), 1 deletion(-) |
| 57 | + |
| 58 | +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c |
| 59 | +index 838f57fa5..04d058f55 100644 |
| 60 | +--- a/grub-core/normal/main.c |
| 61 | ++++ b/grub-core/normal/main.c |
| 62 | +@@ -582,7 +582,9 @@ GRUB_MOD_FINI(normal) |
| 63 | + grub_xputs = grub_xputs_saved; |
| 64 | + |
| 65 | + grub_set_history (0); |
| 66 | +- grub_register_variable_hook ("pager", 0, 0); |
| 67 | ++ grub_register_variable_hook ("pager", NULL, NULL); |
| 68 | ++ grub_register_variable_hook ("color_normal", NULL, NULL); |
| 69 | ++ grub_register_variable_hook ("color_highlight", NULL, NULL); |
| 70 | + grub_fs_autoload_hook = 0; |
| 71 | + grub_unregister_command (cmd_clear); |
| 72 | + grub_unregister_command (cmd_normal); |
| 73 | + grub_unregister_command (cmd_normal_exit); |
| 74 | + } |
| 75 | +-- |
| 76 | +2.45.4 |
| 77 | + |
| 78 | + |
| 79 | +From 7580addfc8c94cedb0cdfd7a1fd65b539215e637 Mon Sep 17 00:00:00 2001 |
| 80 | +From: B Horn <b@horn.uk> |
| 81 | +Date: Fri, 1 Nov 2024 23:52:06 +0000 |
| 82 | +Subject: [PATCH 3/3] gettext: Remove variables hooks on module unload |
| 83 | + |
| 84 | +The gettext module does not entirely cleanup after itself in |
| 85 | +its GRUB_MOD_FINI() leaving a few variables hooks in place. |
| 86 | +It is not possible to unload gettext module because normal |
| 87 | +module depends on it. Though fix the issues for completeness. |
| 88 | + |
| 89 | +Fixes: CVE-2025-0622 |
| 90 | + |
| 91 | +Reported-by: B Horn <b@horn.uk> |
| 92 | +Signed-off-by: B Horn <b@horn.uk> |
| 93 | +Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com> |
| 94 | +--- |
| 95 | + grub-core/gettext/gettext.c | 4 ++++ |
| 96 | + 1 file changed, 4 insertions(+) |
| 97 | + |
| 98 | +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c |
| 99 | +index 7a1c14e4f..e4f4f8ee6 100644 |
| 100 | +--- a/grub-core/gettext/gettext.c |
| 101 | ++++ b/grub-core/gettext/gettext.c |
| 102 | +@@ -544,6 +544,10 @@ GRUB_MOD_FINI (gettext) |
| 103 | + { |
| 104 | + grub_unregister_command (cmd); |
| 105 | + |
| 106 | ++ grub_register_variable_hook ("locale_dir", NULL, NULL); |
| 107 | ++ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL); |
| 108 | ++ grub_register_variable_hook ("lang", NULL, NULL); |
| 109 | ++ |
| 110 | + grub_gettext_delete_list (&main_context); |
| 111 | + grub_gettext_delete_list (&secondary_context); |
| 112 | + |
| 113 | +-- |
| 114 | +2.45.4 |
| 115 | + |
0 commit comments