summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHitendra Prajapati <hprajapati@mvista.com>2025-03-13 13:01:29 +0530
committerSteve Sakoman <steve@sakoman.com>2025-03-19 07:13:17 -0700
commit7b99a13f6f6567137f27bdd2b31724d94672c06f (patch)
tree339b04e8753df2a587be19e4d761aa1843880c6f
parent12da3c7d02daa5cc1592931724902eb5a3c4be33 (diff)
downloadpoky-7b99a13f6f6567137f27bdd2b31724d94672c06f.tar.gz
grub: Fix multiple CVEs
Backport fixes for: * CVE-2024-45774 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2c34af908ebf4856051ed29e46d88abd2b20387f * CVE-2024-45775 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872 * CVE-2024-45776 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91 * CVE-2024-45777 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b970a5ed967816bbca8225994cd0ee2557bad515 * CVE-2024-45778_CVE-2024-45779 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630 * CVE-2024-45780 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3 * CVE-2024-45781 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba * CVE-2024-45782_CVE-2024-56737 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=417547c10410b714e43f08f74137c24015f8f4c3 * CVE-2024-45783 - Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898 (From OE-Core rev: 1bf2e89c932167b677051234d4e0cc4c52b0ee0c) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch68
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45774.patch40
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45775.patch41
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45776.patch42
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45777.patch60
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch58
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45780.patch96
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45781.patch38
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch39
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45783.patch42
-rw-r--r--meta/recipes-bsp/grub/grub2.inc10
11 files changed, 534 insertions, 0 deletions
diff --git a/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch b/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
new file mode 100644
index 0000000000..0ff6dff33a
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
@@ -0,0 +1,68 @@
1From ea703528a8581a2ea7e0bad424a70fdf0aec7d8f Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sat, 15 Jun 2024 02:33:08 +0100
4Subject: [PATCH 1/2] misc: Implement grub_strlcpy()
5
6grub_strlcpy() acts the same way as strlcpy() does on most *NIX,
7returning the length of src and ensuring dest is always NUL
8terminated except when size is 0.
9
10Signed-off-by: B Horn <b@horn.uk>
11Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
12
13Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f]
14Signed-off-by: Peter Marko <peter.marko@siemens.com>
15---
16 include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++
17 1 file changed, 39 insertions(+)
18
19diff --git a/include/grub/misc.h b/include/grub/misc.h
20index 1578f36c3..14d8f37ac 100644
21--- a/include/grub/misc.h
22+++ b/include/grub/misc.h
23@@ -64,6 +64,45 @@ grub_stpcpy (char *dest, const char *src)
24 return d - 1;
25 }
26
27+static inline grub_size_t
28+grub_strlcpy (char *dest, const char *src, grub_size_t size)
29+{
30+ char *d = dest;
31+ grub_size_t res = 0;
32+ /*
33+ * We do not subtract one from size here to avoid dealing with underflowing
34+ * the value, which is why to_copy is always checked to be greater than one
35+ * throughout this function.
36+ */
37+ grub_size_t to_copy = size;
38+
39+ /* Copy size - 1 bytes to dest. */
40+ if (to_copy > 1)
41+ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1)
42+ ;
43+
44+ /*
45+ * NUL terminate if size != 0. The previous step may have copied a NUL byte
46+ * if it reached the end of the string, but we know dest[size - 1] must always
47+ * be a NUL byte.
48+ */
49+ if (size != 0)
50+ dest[size - 1] = '\0';
51+
52+ /* If there is still space in dest, but are here, we reached the end of src. */
53+ if (to_copy > 1)
54+ return res;
55+
56+ /*
57+ * If we haven't reached the end of the string, iterate through to determine
58+ * the strings total length.
59+ */
60+ while (*src++ != '\0' && ++res)
61+ ;
62+
63+ return res;
64+}
65+
66 /* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */
67 static inline void *
68 grub_memcpy (void *dest, const void *src, grub_size_t n)
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45774.patch b/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
new file mode 100644
index 0000000000..f4cbd50022
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
@@ -0,0 +1,40 @@
1From 2c34af908ebf4856051ed29e46d88abd2b20387f Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Fri, 8 Mar 2024 22:47:20 +1100
4Subject: [PATCH] video/readers/jpeg: Do not permit duplicate SOF0 markers in
5 JPEG
6
7Otherwise a subsequent header could change the height and width
8allowing future OOB writes.
9
10Fixes: CVE-2024-45774
11
12Reported-by: Nils Langius <nils@langius.de>
13Signed-off-by: Daniel Axtens <dja@axtens.net>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45774
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2c34af908ebf4856051ed29e46d88abd2b20387f]
18Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
19---
20 grub-core/video/readers/jpeg.c | 4 ++++
21 1 file changed, 4 insertions(+)
22
23diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
24index 6019b6a..5e5e39c 100644
25--- a/grub-core/video/readers/jpeg.c
26+++ b/grub-core/video/readers/jpeg.c
27@@ -330,6 +330,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
28 if (grub_errno != GRUB_ERR_NONE)
29 return grub_errno;
30
31+ if (data->image_height != 0 || data->image_width != 0)
32+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
33+ "jpeg: cannot have duplicate SOF0 markers");
34+
35 if (grub_jpeg_get_byte (data) != 8)
36 return grub_error (GRUB_ERR_BAD_FILE_TYPE,
37 "jpeg: only 8-bit precision is supported");
38--
392.25.1
40
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45775.patch b/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
new file mode 100644
index 0000000000..4328e4249f
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
@@ -0,0 +1,41 @@
1From 05be856a8c3aae41f5df90cab7796ab7ee34b872 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:55 +0000
4Subject: [PATCH] commands/extcmd: Missing check for failed allocation
5
6The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate
7a grub_arg_list struct but it does not verify the allocation was successful.
8In case of failed allocation the NULL state pointer can be accessed in
9parse_option() through grub_arg_parse() which may lead to a security issue.
10
11Fixes: CVE-2024-45775
12
13Reported-by: Nils Langius <nils@langius.de>
14Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
16Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
17
18CVE: CVE-2024-45775
19Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872]
20Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
21---
22 grub-core/commands/extcmd.c | 3 +++
23 1 file changed, 3 insertions(+)
24
25diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
26index 90a5ca2..c236be1 100644
27--- a/grub-core/commands/extcmd.c
28+++ b/grub-core/commands/extcmd.c
29@@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args,
30 }
31
32 state = grub_arg_list_alloc (ext, argc, args);
33+ if (state == NULL)
34+ return grub_errno;
35+
36 if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc))
37 {
38 context.state = state;
39--
402.25.1
41
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45776.patch b/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
new file mode 100644
index 0000000000..66b997dd69
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
@@ -0,0 +1,42 @@
1From 09bd6eb58b0f71ec273916070fa1e2de16897a91 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:56 +0000
4Subject: [PATCH] gettext: Integer overflow leads to heap OOB write or read
5
6Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may
7overflow leading to subsequent OOB write or read. This patch fixes the
8issue by replacing grub_zalloc() and explicit multiplication with
9grub_calloc() which does the same thing in safe manner.
10
11Fixes: CVE-2024-45776
12
13Reported-by: Nils Langius <nils@langius.de>
14Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
16Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
17
18CVE: CVE-2024-45776
19Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91]
20Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
21---
22 grub-core/gettext/gettext.c | 4 ++--
23 1 file changed, 2 insertions(+), 2 deletions(-)
24
25diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
26index 4d02e62..55d8b67 100644
27--- a/grub-core/gettext/gettext.c
28+++ b/grub-core/gettext/gettext.c
29@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx,
30 for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log;
31 ctx->grub_gettext_max_log++);
32
33- ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max
34- * sizeof (ctx->grub_gettext_msg_list[0]));
35+ ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max,
36+ sizeof (ctx->grub_gettext_msg_list[0]));
37 if (!ctx->grub_gettext_msg_list)
38 {
39 grub_file_close (fd);
40--
412.25.1
42
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45777.patch b/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
new file mode 100644
index 0000000000..2591609760
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
@@ -0,0 +1,60 @@
1From b970a5ed967816bbca8225994cd0ee2557bad515 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:57 +0000
4Subject: [PATCH] gettext: Integer overflow leads to heap OOB write
5
6The size calculation of the translation buffer in
7grub_gettext_getstr_from_position() may overflow
8to 0 leading to heap OOB write. This patch fixes
9the issue by using grub_add() and checking for
10an overflow.
11
12Fixes: CVE-2024-45777
13
14Reported-by: Nils Langius <nils@langius.de>
15Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
18
19CVE: CVE-2024-45777
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b970a5ed967816bbca8225994cd0ee2557bad515]
21Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
22---
23 grub-core/gettext/gettext.c | 7 ++++++-
24 1 file changed, 6 insertions(+), 1 deletion(-)
25
26diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
27index 55d8b67..85ea44a 100644
28--- a/grub-core/gettext/gettext.c
29+++ b/grub-core/gettext/gettext.c
30@@ -26,6 +26,7 @@
31 #include <grub/file.h>
32 #include <grub/kernel.h>
33 #include <grub/i18n.h>
34+#include <grub/safemath.h>
35
36 GRUB_MOD_LICENSE ("GPLv3+");
37
38@@ -99,6 +100,7 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
39 char *translation;
40 struct string_descriptor desc;
41 grub_err_t err;
42+ grub_size_t alloc_sz;
43
44 internal_position = (off + position * sizeof (desc));
45
46@@ -109,7 +111,10 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
47 length = grub_cpu_to_le32 (desc.length);
48 offset = grub_cpu_to_le32 (desc.offset);
49
50- translation = grub_malloc (length + 1);
51+ if (grub_add (length, 1, &alloc_sz))
52+ return NULL;
53+
54+ translation = grub_malloc (alloc_sz);
55 if (!translation)
56 return NULL;
57
58--
592.25.1
60
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch b/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
new file mode 100644
index 0000000000..e224c41776
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
@@ -0,0 +1,58 @@
1From 26db6605036bd9e5b16d9068a8cc75be63b8b630 Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Sat, 23 Mar 2024 15:59:43 +1100
4Subject: [PATCH] fs/bfs: Disable under lockdown
5
6The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown.
7This will also disable the AFS.
8
9Fixes: CVE-2024-45778
10Fixes: CVE-2024-45779
11
12Reported-by: Nils Langius <nils@langius.de>
13Signed-off-by: Daniel Axtens <dja@axtens.net>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45778
17CVE: CVE-2024-45779
18Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=26db6605036bd9e5b16d9068a8cc75be63b8b630]
19Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
20---
21 grub-core/fs/bfs.c | 9 +++++++--
22 1 file changed, 7 insertions(+), 2 deletions(-)
23
24diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c
25index 47dbe20..8d704e2 100644
26--- a/grub-core/fs/bfs.c
27+++ b/grub-core/fs/bfs.c
28@@ -30,6 +30,7 @@
29 #include <grub/types.h>
30 #include <grub/i18n.h>
31 #include <grub/fshelp.h>
32+#include <grub/lockdown.h>
33
34 GRUB_MOD_LICENSE ("GPLv3+");
35
36@@ -1104,7 +1105,10 @@ GRUB_MOD_INIT (bfs)
37 {
38 COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE ==
39 sizeof (struct grub_bfs_extent));
40- grub_fs_register (&grub_bfs_fs);
41+ if (!grub_is_lockdown ())
42+ {
43+ grub_fs_register (&grub_bfs_fs);
44+ }
45 }
46
47 #ifdef MODE_AFS
48@@ -1113,5 +1117,6 @@ GRUB_MOD_FINI (afs)
49 GRUB_MOD_FINI (bfs)
50 #endif
51 {
52- grub_fs_unregister (&grub_bfs_fs);
53+ if (!grub_is_lockdown ())
54+ grub_fs_unregister (&grub_bfs_fs);
55 }
56--
572.25.1
58
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45780.patch b/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
new file mode 100644
index 0000000000..91d1e11005
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
@@ -0,0 +1,96 @@
1From 0087bc6902182fe5cedce2d034c75a79cf6dd4f3 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:58 +0000
4Subject: [PATCH] fs/tar: Integer overflow leads to heap OOB write
5
6Both namesize and linksize are derived from hd.size, a 12-digit octal
7number parsed by read_number(). Later direct arithmetic calculation like
8"namesize + 1" and "linksize + 1" may exceed the maximum value of
9grub_size_t leading to heap OOB write. This patch fixes the issue by
10using grub_add() and checking for an overflow.
11
12Fixes: CVE-2024-45780
13
14Reported-by: Nils Langius <nils@langius.de>
15Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
18
19CVE: CVE-2024-45780
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3]
21Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
22---
23 grub-core/fs/tar.c | 23 ++++++++++++++++++-----
24 1 file changed, 18 insertions(+), 5 deletions(-)
25
26diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
27index c551ed6..a9e39b0 100644
28--- a/grub-core/fs/tar.c
29+++ b/grub-core/fs/tar.c
30@@ -25,6 +25,7 @@
31 #include <grub/mm.h>
32 #include <grub/dl.h>
33 #include <grub/i18n.h>
34+#include <grub/safemath.h>
35
36 GRUB_MOD_LICENSE ("GPLv3+");
37
38@@ -76,6 +77,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
39 {
40 struct head hd;
41 int reread = 0, have_longname = 0, have_longlink = 0;
42+ grub_size_t sz;
43
44 data->hofs = data->next_hofs;
45
46@@ -97,7 +99,11 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
47 {
48 grub_err_t err;
49 grub_size_t namesize = read_number (hd.size, sizeof (hd.size));
50- *name = grub_malloc (namesize + 1);
51+
52+ if (grub_add (namesize, 1, &sz))
53+ return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow"));
54+
55+ *name = grub_malloc (sz);
56 if (*name == NULL)
57 return grub_errno;
58 err = grub_disk_read (data->disk, 0,
59@@ -117,15 +123,19 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
60 {
61 grub_err_t err;
62 grub_size_t linksize = read_number (hd.size, sizeof (hd.size));
63- if (data->linkname_alloc < linksize + 1)
64+
65+ if (grub_add (linksize, 1, &sz))
66+ return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow"));
67+
68+ if (data->linkname_alloc < sz)
69 {
70 char *n;
71- n = grub_calloc (2, linksize + 1);
72+ n = grub_calloc (2, sz);
73 if (!n)
74 return grub_errno;
75 grub_free (data->linkname);
76 data->linkname = n;
77- data->linkname_alloc = 2 * (linksize + 1);
78+ data->linkname_alloc = 2 * (sz);
79 }
80
81 err = grub_disk_read (data->disk, 0,
82@@ -148,7 +158,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
83 while (extra_size < sizeof (hd.prefix)
84 && hd.prefix[extra_size])
85 extra_size++;
86- *name = grub_malloc (sizeof (hd.name) + extra_size + 2);
87+
88+ if (grub_add (sizeof (hd.name) + 2, extra_size, &sz))
89+ return grub_error (GRUB_ERR_BAD_FS, N_("long name size overflow"));
90+ *name = grub_malloc (sz);
91 if (*name == NULL)
92 return grub_errno;
93 if (hd.prefix[0])
94--
952.25.1
96
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45781.patch b/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
new file mode 100644
index 0000000000..fb91fa45c7
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
@@ -0,0 +1,38 @@
1From c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sun, 12 May 2024 02:03:33 +0100
4Subject: [PATCH 2/2] fs/ufs: Fix a heap OOB write
5
6grub_strcpy() was used to copy a symlink name from the filesystem
7image to a heap allocated buffer. This led to a OOB write to adjacent
8heap allocations. Fix by using grub_strlcpy().
9
10Fixes: CVE-2024-45781
11
12Reported-by: B Horn <b@horn.uk>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45781
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba]
18Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
19---
20 grub-core/fs/ufs.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
24index 34a698b..4727266 100644
25--- a/grub-core/fs/ufs.c
26+++ b/grub-core/fs/ufs.c
27@@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino)
28 /* Check against zero is paylindromic, no need to swap. */
29 if (data->inode.nblocks == 0
30 && INODE_SIZE (data) <= sizeof (data->inode.symlink))
31- grub_strcpy (symlink, (char *) data->inode.symlink);
32+ grub_strlcpy (symlink, (char *) data->inode.symlink, sz);
33 else
34 {
35 if (grub_ufs_read_file (data, 0, 0, 0, sz, symlink) < 0)
36--
372.25.1
38
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch b/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
new file mode 100644
index 0000000000..5ba779f9ee
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
@@ -0,0 +1,39 @@
1From 417547c10410b714e43f08f74137c24015f8f4c3 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sun, 12 May 2024 02:48:33 +0100
4Subject: [PATCH] fs/hfs: Fix stack OOB write with grub_strcpy()
5
6Replaced with grub_strlcpy().
7
8Fixes: CVE-2024-45782
9Fixes: CVE-2024-56737
10Fixes: https://savannah.gnu.org/bugs/?66599
11
12Reported-by: B Horn <b@horn.uk>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45782
17CVE: CVE-2024-56737
18Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=417547c10410b714e43f08f74137c24015f8f4c3]
19Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
20---
21 grub-core/fs/hfs.c | 2 +-
22 1 file changed, 1 insertion(+), 1 deletion(-)
23
24diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
25index f419965..bb7af5f 100644
26--- a/grub-core/fs/hfs.c
27+++ b/grub-core/fs/hfs.c
28@@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk)
29 volume name. */
30 key.parent_dir = grub_cpu_to_be32_compile_time (1);
31 key.strlen = data->sblock.volname[0];
32- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1));
33+ grub_strlcpy ((char *) key.str, (char *) (data->sblock.volname + 1), sizeof (key.str));
34
35 if (grub_hfs_find_node (data, (char *) &key, data->cat_root,
36 0, (char *) &dir, sizeof (dir)) == 0)
37--
382.25.1
39
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45783.patch b/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
new file mode 100644
index 0000000000..793192d05a
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
@@ -0,0 +1,42 @@
1From f7c070a2e28dfab7137db0739fb8db1dc02d8898 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sun, 12 May 2024 06:22:51 +0100
4Subject: [PATCH] fs/hfsplus: Set a grub_errno if mount fails
5
6It was possible for mount to fail but not set grub_errno. This led to
7a possible double decrement of the module reference count if the NULL
8page was mapped.
9
10Fixing in general as a similar bug was fixed in commit 61b13c187
11(fs/hfsplus: Set grub_errno to prevent NULL pointer access) and there
12are likely more variants around.
13
14Fixes: CVE-2024-45783
15
16Reported-by: B Horn <b@horn.uk>
17Signed-off-by: B Horn <b@horn.uk>
18Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
19
20CVE: CVE-2024-45783
21Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898]
22Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
23---
24 grub-core/fs/hfsplus.c | 2 +-
25 1 file changed, 1 insertion(+), 1 deletion(-)
26
27diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
28index 19c7b33..e7fd98a 100644
29--- a/grub-core/fs/hfsplus.c
30+++ b/grub-core/fs/hfsplus.c
31@@ -393,7 +393,7 @@ grub_hfsplus_mount (grub_disk_t disk)
32
33 fail:
34
35- if (grub_errno == GRUB_ERR_OUT_OF_RANGE)
36+ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE)
37 grub_error (GRUB_ERR_BAD_FS, "not a HFS+ filesystem");
38
39 grub_free (data);
40--
412.25.1
42
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 3e96426b82..259a0a4c3d 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -41,6 +41,16 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
41 file://CVE-2023-4692.patch \ 41 file://CVE-2023-4692.patch \
42 file://CVE-2023-4693.patch \ 42 file://CVE-2023-4693.patch \
43 file://0001-fs-fat-Don-t-error-when-mtime-is-0.patch \ 43 file://0001-fs-fat-Don-t-error-when-mtime-is-0.patch \
44 file://0001-misc-Implement-grub_strlcpy.patch \
45 file://CVE-2024-45774.patch \
46 file://CVE-2024-45775.patch \
47 file://CVE-2024-45776.patch \
48 file://CVE-2024-45777.patch \
49 file://CVE-2024-45778_CVE-2024-45779.patch \
50 file://CVE-2024-45780.patch \
51 file://CVE-2024-45781.patch \
52 file://CVE-2024-45782_CVE-2024-56737.patch \
53 file://CVE-2024-45783.patch \
44" 54"
45 55
46SRC_URI[sha256sum] = "23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f" 56SRC_URI[sha256sum] = "23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-05 17:15:40 +0000