linux/poky.git/meta/recipes-bsp/grub, branch mickledore

grub: Fix for CVE-2023-4692 and CVE-2023-4693

2023-11-13T22:22:20+00:00

CVE: CVE-2023-4692 Crafted file system images can cause heap-based buffer overflow and may allow arbitrary code execution and secure boot bypass. Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=43651027d24e62a7a463254165e1e46e42aecdea] CVE: CVE-2023-4693 There an out-of-bounds read at fs/ntfs.c, a physically present attacker may leverage that by presenting a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack may allow sensitive data cached in memory or EFI variables values to be leaked presenting a high Confidentiality risk. Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0ed2458cc4eff6d9a9199527e2a0b6d445802f94] (From OE-Core rev: 51236150a3740d95e3601499d3918af5a37f8f86) Signed-off-by: Xiangyu Chen Signed-off-by: Alexandre Belloni (cherry picked from commit: a8bc6f041599ce8da275c163c87f155a2f09369c) Signed-off-by: Xiangyu Chen Signed-off-by: Steve Sakoman

grub: submit determinism.patch upstream

2023-07-04T15:32:29+00:00

(From OE-Core rev: ce5337d19ad290f30c0250158a1833a2cc3bd0ac) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 61947762e410c685f667e0af6440fb8a33cd6777) Signed-off-by: Steve Sakoman

grub2: support metadata_csum_seed feature

2023-03-07T10:45:25+00:00

It enable the metadata_csum_seed feature by default in e2fsprogs 1.47.0 and causes grub doesn't work. Backport patch to make grub support this feature. (From OE-Core rev: ae3b4588d69e534ac8aff136ed44f3975f5a2d4f) Signed-off-by: Kai Kang Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

grub: Handle R_RISCV_CALL_PLT reloc

2023-02-24T11:04:27+00:00

These are new in binutils 2.40+ (From OE-Core rev: f2883fb1d7302087479940b422ba836d2fe35fc4) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

grub2: backport patch to fix CVE-2022-2601 CVE-2022-3775

2022-12-26T18:49:07+00:00

Backport patch from upstream to solve CVE-2022-2601 CVE-2022-3775 dependency: font: Fix size overflow in grub_font_get_glyph_internal() (https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c76ec09ae08155df27cd237eaea150b4f02f532) Backport patch from upstream to fix following CVEs: CVE-2022-2601: font: Fix several integer overflows in grub_font_construct_glyph() (https://git.savannah.gnu.org/cgit/grub.git/commit/?id=768e1ef2fc159f6e14e7246e4be09363708ac39e) CVE-2022-3775: font: Fix an integer underflow in blit_comb() (https://git.savannah.gnu.org/cgit/grub.git/commit/?id=992c06191babc1e109caf40d6a07ec6fdef427af) (From OE-Core rev: fa5a42150098be892246146456faed778e28ef94) Signed-off-by: Xiangyu Chen Signed-off-by: Steve Sakoman Signed-off-by: Liwei Song Signed-off-by: Richard Purdie

grub: backport patches to fix CVE-2022-28736

2022-12-08T10:48:36+00:00

(From OE-Core rev: 278e1a0f679be813553b014544314041502a586a) Signed-off-by: Xiangyu Chen Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

grub: disable build on armv7ve/a with hardfp

2022-10-26T11:28:39+00:00

The commit(75dbdea940 grub: Allow build on armv7ve/a with softfp) enable build on armv7ve/a with softfp, but it acutally enable build on armv7ve/a with hardfp altogether and result in below build failure: | checking for compile options to get strict alignment... -mno-unaligned-access | checking if compiler generates unaligned accesses... no | checking if C symbols get an underscore after compilation... no | checking whether target compiler is working... no | configure: error: cannot compile for the target So update the check to disable build on armv7ve/a with hardfp. (From OE-Core rev: f67b2880fc2cfb21f51216c63b5f24d0524b4278) Signed-off-by: Mingli Yu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

grub: Allow build on armv7ve/a with softfp

2022-09-21T08:20:49+00:00

Grub tries to force the compilation in softfp mode for some known target CPU. That is because it doesn't use floats or doubles and there are known limitations of using a configuration with hardfp. There are though target CPUs that grub won't know how to configure failing with something similar to: | checking for options to get soft-float... no | configure: error: could not force soft-float This change relaxes a bit the COMPATIBLE_HOST restriction to only apply for hardfp configuration even for arm7ve/a. (From OE-Core rev: 75dbdea94057b6977a20fb738c00c226ca694243) Signed-off-by: Andrei Gherzan Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

grub: Apply backports to fix build with clang on x86

2022-09-20T22:17:53+00:00

(From OE-Core rev: 2213b6ce1ec944228d7bb3c95f2e02ac0995b5be) Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

grub2: fix several CVEs

2022-08-21T21:51:41+00:00

Backport CVE patches from upstream to fix: CVE-2021-3695 CVE-2021-3696 CVE-2021-3697 CVE-2022-28733 CVE-2022-28734 CVE-2022-28735 Backport the following 5 patches to make CVE patches be applied smoothly. video-Remove-trailing-whitespaces.patch video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch (From OE-Core rev: db43401a3a4c201f02f4128fa4bac8ce993bfec0) Signed-off-by: Yongxin Liu Signed-off-by: Richard Purdie