From 584263eca1546e5cab69ba6fe7b4b07df2630a21 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 14 Oct 2020 16:33:42 +0200 Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown is enforced The cutmem and badram commands can be used to remove EFI memory regions and potentially disable the UEFI Secure Boot. Prevent the commands to be registered if the GRUB is locked down. Fixes: CVE-2020-27779 Reported-by: Teddy Reed Signed-off-by: Javier Martinez Canillas Reviewed-by: Daniel Kiper Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=d298b41f90cbf1f2e5a10e29daa1fc92ddee52c9] CVE: CVE-2020-27779 Signed-off-by: Marta Rybczynska --- docs/grub.texi | 4 ++++ grub-core/mmap/mmap.c | 13 +++++++------ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/docs/grub.texi b/docs/grub.texi index 47ac7ff..a1aaee6 100644 --- a/docs/grub.texi +++ b/docs/grub.texi @@ -4051,6 +4051,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns that are often result of memory damage, due to physical distribution of memory cells. +Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}). + This prevents removing EFI memory regions to potentially subvert the + security mechanisms provided by the UEFI secure boot. + @node blocklist @subsection blocklist diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c index 57b4e9a..7ebf32e 100644 --- a/grub-core/mmap/mmap.c +++ b/grub-core/mmap/mmap.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include #include @@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut; GRUB_MOD_INIT(mmap) { - cmd = grub_register_command ("badram", grub_cmd_badram, - N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"), - N_("Declare memory regions as faulty (badram).")); - cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem, - N_("FROM[K|M|G] TO[K|M|G]"), - N_("Remove any memory regions in specified range.")); + cmd = grub_register_command_lockdown ("badram", grub_cmd_badram, + N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"), + N_("Declare memory regions as faulty (badram).")); + cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem, + N_("FROM[K|M|G] TO[K|M|G]"), + N_("Remove any memory regions in specified range.")); }