Skip to content

Commit f4db6a0

Browse files
Merge PR "[AUTO-CHERRYPICK] fix: Patch CVE-2025-0622 for grub2 and increase sbat to grub,5 - branch 3.0-dev" #16197
Co-authored-by: Lynsey Rydberg <lyrydber@microsoft.com>
1 parent f8a958c commit f4db6a0

5 files changed

Lines changed: 127 additions & 4 deletions

File tree

SPECS-SIGNED/grub2-efi-binary-signed/grub2-efi-binary-signed.spec

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
Summary: Signed GRand Unified Bootloader for %{buildarch} systems
1414
Name: grub2-efi-binary-signed-%{buildarch}
1515
Version: 2.06
16-
Release: 26%{?dist}
16+
Release: 27%{?dist}
1717
License: GPLv3+
1818
Vendor: Microsoft Corporation
1919
Distribution: Azure Linux
@@ -84,6 +84,9 @@ cp %{SOURCE3} %{buildroot}/boot/efi/EFI/%{efidir}/%{grubpxeefiname}
8484
/boot/efi/EFI/%{efidir}/%{grubpxeefiname}
8585

8686
%changelog
87+
* Wed Mar 04 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 2.06-27
88+
- Bump release number to match grub release
89+
8790
* Mon Nov 24 2025 Akhila Guruju <v-guakhila@microsoft.com> - 2.06-26
8891
- Bump release number to match grub release
8992

SPECS/grub2/CVE-2025-0622.patch

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
From 2123c5bca7e21fbeb0263df4597ddd7054700726 Mon Sep 17 00:00:00 2001
2+
From: B Horn <b@horn.uk>
3+
Date: Fri, 1 Nov 2024 19:24:29 +0000
4+
Subject: [PATCH 1/3] commands/pgp: Unregister the "check_signatures" hooks on
5+
module unload
6+
7+
If the hooks are not removed they can be called after the module has
8+
been unloaded leading to an use-after-free.
9+
10+
Fixes: CVE-2025-0622
11+
12+
Reported-by: B Horn <b@horn.uk>
13+
Signed-off-by: B Horn <b@horn.uk>
14+
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15+
---
16+
grub-core/commands/pgp.c | 2 ++
17+
1 file changed, 2 insertions(+)
18+
19+
diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
20+
index c6766f044..5fadc33c4 100644
21+
--- a/grub-core/commands/pgp.c
22+
+++ b/grub-core/commands/pgp.c
23+
@@ -1010,6 +1010,8 @@ GRUB_MOD_INIT(pgp)
24+
25+
GRUB_MOD_FINI(pgp)
26+
{
27+
+ grub_register_variable_hook ("check_signatures", NULL, NULL);
28+
+ grub_env_unset ("check_signatures");
29+
grub_verifier_unregister (&grub_pubkey_verifier);
30+
grub_unregister_extcmd (cmd);
31+
grub_unregister_extcmd (cmd_trust);
32+
--
33+
2.45.4
34+
35+
36+
From 9c16197734ada8d0838407eebe081117799bfe67 Mon Sep 17 00:00:00 2001
37+
From: B Horn <b@horn.uk>
38+
Date: Fri, 1 Nov 2024 23:46:55 +0000
39+
Subject: [PATCH 2/3] normal: Remove variables hooks on module unload
40+
41+
The normal module does not entirely cleanup after itself in
42+
its GRUB_MOD_FINI() leaving a few variables hooks in place.
43+
It is not possible to unload normal module now but fix the
44+
issues for completeness.
45+
46+
On the occasion replace 0s with NULLs for "pager" variable
47+
hooks unregister.
48+
49+
Fixes: CVE-2025-0622
50+
51+
Reported-by: B Horn <b@horn.uk>
52+
Signed-off-by: B Horn <b@horn.uk>
53+
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
54+
---
55+
grub-core/normal/main.c | 4 +++-
56+
1 file changed, 3 insertions(+), 1 deletion(-)
57+
58+
diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
59+
index 838f57fa5..04d058f55 100644
60+
--- a/grub-core/normal/main.c
61+
+++ b/grub-core/normal/main.c
62+
@@ -582,7 +582,9 @@ GRUB_MOD_FINI(normal)
63+
grub_xputs = grub_xputs_saved;
64+
65+
grub_set_history (0);
66+
- grub_register_variable_hook ("pager", 0, 0);
67+
+ grub_register_variable_hook ("pager", NULL, NULL);
68+
+ grub_register_variable_hook ("color_normal", NULL, NULL);
69+
+ grub_register_variable_hook ("color_highlight", NULL, NULL);
70+
grub_fs_autoload_hook = 0;
71+
grub_unregister_command (cmd_clear);
72+
grub_unregister_command (cmd_normal);
73+
grub_unregister_command (cmd_normal_exit);
74+
}
75+
--
76+
2.45.4
77+
78+
79+
From 7580addfc8c94cedb0cdfd7a1fd65b539215e637 Mon Sep 17 00:00:00 2001
80+
From: B Horn <b@horn.uk>
81+
Date: Fri, 1 Nov 2024 23:52:06 +0000
82+
Subject: [PATCH 3/3] gettext: Remove variables hooks on module unload
83+
84+
The gettext module does not entirely cleanup after itself in
85+
its GRUB_MOD_FINI() leaving a few variables hooks in place.
86+
It is not possible to unload gettext module because normal
87+
module depends on it. Though fix the issues for completeness.
88+
89+
Fixes: CVE-2025-0622
90+
91+
Reported-by: B Horn <b@horn.uk>
92+
Signed-off-by: B Horn <b@horn.uk>
93+
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
94+
---
95+
grub-core/gettext/gettext.c | 4 ++++
96+
1 file changed, 4 insertions(+)
97+
98+
diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
99+
index 7a1c14e4f..e4f4f8ee6 100644
100+
--- a/grub-core/gettext/gettext.c
101+
+++ b/grub-core/gettext/gettext.c
102+
@@ -544,6 +544,10 @@ GRUB_MOD_FINI (gettext)
103+
{
104+
grub_unregister_command (cmd);
105+
106+
+ grub_register_variable_hook ("locale_dir", NULL, NULL);
107+
+ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
108+
+ grub_register_variable_hook ("lang", NULL, NULL);
109+
+
110+
grub_gettext_delete_list (&main_context);
111+
grub_gettext_delete_list (&secondary_context);
112+
113+
--
114+
2.45.4
115+

SPECS/grub2/grub2.signatures.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
"Signatures": {
33
"gnulib-d271f868a8df9bbec29049d01e056481b7a1a263.tar.gz": "4e23415ae2977ffca15e07419ceff3e9334d0369eafc9e7ae2578f8dd9a4839c",
44
"grub-2.06.tar.gz": "660eaa2355a4045d8d0cdb5765169d1cad9912ec07873b86c9c6d55dbaa9dfca",
5-
"sbat.csv.in": "bda0c179d651655f126c508673bbf80505b4aa4b64c347409f4d7ec668b164f0"
5+
"sbat.csv.in": "d0591975060289753d67c1653b7459d002a736dd40ecfd36b2689033d4891240"
66
}
77
}

SPECS/grub2/grub2.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
Summary: GRand Unified Bootloader
88
Name: grub2
99
Version: 2.06
10-
Release: 26%{?dist}
10+
Release: 27%{?dist}
1111
License: GPLv3+
1212
Vendor: Microsoft Corporation
1313
Distribution: Azure Linux
@@ -130,6 +130,7 @@ Patch: CVE-2024-45780.patch
130130
Patch: CVE-2025-61661.patch
131131
Patch: CVE-2025-61662.patch
132132
Patch: CVE-2025-61663.patch
133+
Patch: CVE-2025-0622.patch
133134
# Following are included as part of above CVEs and kept here as nopatch
134135
# and commented out, because from patch command perspective, these files
135136
# have garbage content.
@@ -467,6 +468,10 @@ cp $GRUB_PXE_MODULE_SOURCE $EFI_BOOT_DIR/$GRUB_PXE_MODULE_NAME
467468
%config(noreplace) %{_sysconfdir}/grub.d/41_custom
468469

469470
%changelog
471+
* Wed Mar 04 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 2.06-27
472+
- Patch CVE-2025-0622
473+
- Bump SBAT to grub,5
474+
470475
* Mon Nov 24 2025 Akhila Guruju <v-guakhila@microsoft.com> - 2.06-26
471476
- Patch CVE-2025-61661, CVE-2025-61662 & CVE-2025-61663
472477

SPECS/grub2/sbat.csv.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
2-
grub,4,Free Software Foundation,grub,@@VERSION@@,https://www.gnu.org/software/grub/
2+
grub,5,Free Software Foundation,grub,@@VERSION@@,https://www.gnu.org/software/grub/
33
grub.azurelinux,3,Microsoft,grub2,@@VERSION_RELEASE@@,https://github.com/microsoft/azurelinux
44
grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com

0 commit comments

Comments
 (0)