mirror of
https://github.com/godotengine/buildroot.git
synced 2026-01-04 06:10:16 +03:00
7958c928fb
Details: https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html
Fixes the following security issues:
* CVE-2020-10713
A flaw was found in grub2, prior to version 2.06. An attacker may
use the GRUB 2 flaw to hijack and tamper the GRUB verification
process. This flaw also allows the bypass of Secure Boot
protections. In order to load an untrusted or modified kernel, an
attacker would first need to establish access to the system such as
gaining physical access, obtain the ability to alter a pxe-boot
network, or have remote access to a networked system with root
access. With this access, an attacker could then craft a string to
cause a buffer overflow by injecting a malicious payload that leads
to arbitrary code execution within GRUB. The highest threat from
this vulnerability is to data confidentiality and integrity as well
as system availability.
* CVE-2020-14308
In grub2 versions before 2.06 the grub memory allocator doesn't
check for possible arithmetic overflows on the requested allocation
size. This leads the function to return invalid memory allocations
which can be further used to cause possible integrity,
confidentiality and availability impacts during the boot process.
* CVE-2020-14309
There's an issue with grub2 in all versions before 2.06 when
handling squashfs filesystems containing a symbolic link with name
length of UINT32 bytes in size. The name size leads to an
arithmetic overflow leading to a zero-size allocation further
causing a heap-based buffer overflow with attacker controlled data.
* CVE-2020-14310
An integer overflow in read_section_from_string may lead to a heap
based buffer overflow.
* CVE-2020-14311
An integer overflow in grub_ext2_read_link may lead to a heap-based
buffer overflow.
* CVE-2020-15706
GRUB2 contains a race condition in grub_script_function_create()
leading to a use-after-free vulnerability which can be triggered by
redefining a function whilst the same function is already
executing, leading to arbitrary code execution and secure boot
restriction bypass
* CVE-2020-15707
Integer overflows were discovered in the functions grub_cmd_initrd
and grub_initrd_init in the efilinux component of GRUB2, as shipped
in Debian, Red Hat, and Ubuntu (the functionality is not included
in GRUB2 upstream), leading to a heap-based buffer overflow. These
could be triggered by an extremely large number of arguments to the
initrd command on 32-bit architectures, or a crafted filesystem
with very large files on any architecture. An attacker could use
this to execute arbitrary code and bypass UEFI Secure Boot
restrictions. This issue affects GRUB2 version 2.04 and prior
versions.
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2f7a8021b5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
129 lines
4.5 KiB
Diff
129 lines
4.5 KiB
Diff
From 782a4580a5e347793443aa8e9152db1bf4a0fff8 Mon Sep 17 00:00:00 2001
|
|
From: Peter Jones <pjones@redhat.com>
|
|
Date: Mon, 15 Jun 2020 10:58:42 -0400
|
|
Subject: [PATCH] safemath: Add some arithmetic primitives that check for
|
|
overflow
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
This adds a new header, include/grub/safemath.h, that includes easy to
|
|
use wrappers for __builtin_{add,sub,mul}_overflow() declared like:
|
|
|
|
bool OP(a, b, res)
|
|
|
|
where OP is grub_add, grub_sub or grub_mul. OP() returns true in the
|
|
case where the operation would overflow and res is not modified.
|
|
Otherwise, false is returned and the operation is executed.
|
|
|
|
These arithmetic primitives require newer compiler versions. So, bump
|
|
these requirements in the INSTALL file too.
|
|
|
|
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
|
|
---
|
|
INSTALL | 22 ++--------------------
|
|
include/grub/compiler.h | 8 ++++++++
|
|
include/grub/safemath.h | 37 +++++++++++++++++++++++++++++++++++++
|
|
3 files changed, 47 insertions(+), 20 deletions(-)
|
|
create mode 100644 include/grub/safemath.h
|
|
|
|
diff --git a/INSTALL b/INSTALL
|
|
index 8acb40902..dcb9b7d7b 100644
|
|
--- a/INSTALL
|
|
+++ b/INSTALL
|
|
@@ -11,27 +11,9 @@ GRUB depends on some software packages installed into your system. If
|
|
you don't have any of them, please obtain and install them before
|
|
configuring the GRUB.
|
|
|
|
-* GCC 4.1.3 or later
|
|
- Note: older versions may work but support is limited
|
|
-
|
|
- Experimental support for clang 3.3 or later (results in much bigger binaries)
|
|
+* GCC 5.1.0 or later
|
|
+ Experimental support for clang 3.8.0 or later (results in much bigger binaries)
|
|
for i386, x86_64, arm (including thumb), arm64, mips(el), powerpc, sparc64
|
|
- Note: clang 3.2 or later works for i386 and x86_64 targets but results in
|
|
- much bigger binaries.
|
|
- earlier versions not tested
|
|
- Note: clang 3.2 or later works for arm
|
|
- earlier versions not tested
|
|
- Note: clang on arm64 is not supported due to
|
|
- https://llvm.org/bugs/show_bug.cgi?id=26030
|
|
- Note: clang 3.3 or later works for mips(el)
|
|
- earlier versions fail to generate .reginfo and hence gprel relocations
|
|
- fail.
|
|
- Note: clang 3.2 or later works for powerpc
|
|
- earlier versions not tested
|
|
- Note: clang 3.5 or later works for sparc64
|
|
- earlier versions return "error: unable to interface with target machine"
|
|
- Note: clang has no support for ia64 and hence you can't compile GRUB
|
|
- for ia64 with clang
|
|
* GNU Make
|
|
* GNU Bison 2.3 or later
|
|
* GNU gettext 0.17 or later
|
|
diff --git a/include/grub/compiler.h b/include/grub/compiler.h
|
|
index c9e1d7a73..8f3be3ae7 100644
|
|
--- a/include/grub/compiler.h
|
|
+++ b/include/grub/compiler.h
|
|
@@ -48,4 +48,12 @@
|
|
# define WARN_UNUSED_RESULT
|
|
#endif
|
|
|
|
+#if defined(__clang__) && defined(__clang_major__) && defined(__clang_minor__)
|
|
+# define CLANG_PREREQ(maj,min) \
|
|
+ ((__clang_major__ > (maj)) || \
|
|
+ (__clang_major__ == (maj) && __clang_minor__ >= (min)))
|
|
+#else
|
|
+# define CLANG_PREREQ(maj,min) 0
|
|
+#endif
|
|
+
|
|
#endif /* ! GRUB_COMPILER_HEADER */
|
|
diff --git a/include/grub/safemath.h b/include/grub/safemath.h
|
|
new file mode 100644
|
|
index 000000000..c17b89bba
|
|
--- /dev/null
|
|
+++ b/include/grub/safemath.h
|
|
@@ -0,0 +1,37 @@
|
|
+/*
|
|
+ * GRUB -- GRand Unified Bootloader
|
|
+ * Copyright (C) 2020 Free Software Foundation, Inc.
|
|
+ *
|
|
+ * GRUB is free software: you can redistribute it and/or modify
|
|
+ * it under the terms of the GNU General Public License as published by
|
|
+ * the Free Software Foundation, either version 3 of the License, or
|
|
+ * (at your option) any later version.
|
|
+ *
|
|
+ * GRUB is distributed in the hope that it will be useful,
|
|
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+ * GNU General Public License for more details.
|
|
+ *
|
|
+ * You should have received a copy of the GNU General Public License
|
|
+ * along with GRUB. If not, see <http://www.gnu.org/licenses/>.
|
|
+ *
|
|
+ * Arithmetic operations that protect against overflow.
|
|
+ */
|
|
+
|
|
+#ifndef GRUB_SAFEMATH_H
|
|
+#define GRUB_SAFEMATH_H 1
|
|
+
|
|
+#include <grub/compiler.h>
|
|
+
|
|
+/* These appear in gcc 5.1 and clang 3.8. */
|
|
+#if GNUC_PREREQ(5, 1) || CLANG_PREREQ(3, 8)
|
|
+
|
|
+#define grub_add(a, b, res) __builtin_add_overflow(a, b, res)
|
|
+#define grub_sub(a, b, res) __builtin_sub_overflow(a, b, res)
|
|
+#define grub_mul(a, b, res) __builtin_mul_overflow(a, b, res)
|
|
+
|
|
+#else
|
|
+#error gcc 5.1 or newer or clang 3.8 or newer is required
|
|
+#endif
|
|
+
|
|
+#endif /* GRUB_SAFEMATH_H */
|
|
--
|
|
2.26.2
|
|
|