summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorPeter Marko <peter.marko@siemens.com>2025-03-11 19:14:23 +0100
committerSteve Sakoman <steve@sakoman.com>2025-03-15 06:44:47 -0700
commit373e83b89cb21fc6c875bd9133f2b392a743c48d (patch)
treedc33cdff19f63517b20819925f2372605fc6ae66 /meta
parent51a7eb11928fcae51837095ef557e8ec6cf7eeb8 (diff)
downloadpoky-373e83b89cb21fc6c875bd9133f2b392a743c48d.tar.gz
grub: patch CVE-2025-0677, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686 and CVE-2025-0689
Cherry-pick patch mentioning these CVEs. (From OE-Core rev: 0a2cb15d6953a809135bea69609673d068f46df1) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch377
-rw-r--r--meta/recipes-bsp/grub/grub2.inc1
2 files changed, 378 insertions, 0 deletions
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
new file mode 100644
index 0000000000..d5563cecc4
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
@@ -0,0 +1,377 @@
1From 47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10 Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Sat, 23 Mar 2024 16:20:45 +1100
4Subject: [PATCH] fs: Disable many filesystems under lockdown
5
6The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat,
7hfsplus, iso9660, squash4, tar, xfs and zfs.
8
9The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were
10reported by Jonathan Bar Or <jonathanbaror@gmail.com>.
11
12Fixes: CVE-2025-0677
13Fixes: CVE-2025-0684
14Fixes: CVE-2025-0685
15Fixes: CVE-2025-0686
16Fixes: CVE-2025-0689
17
18Suggested-by: Daniel Axtens <dja@axtens.net>
19Signed-off-by: Daniel Axtens <dja@axtens.net>
20Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
21
22CVE: CVE-2025-0677
23CVE: CVE-2025-0684
24CVE: CVE-2025-0685
25CVE: CVE-2025-0686
26CVE: CVE-2025-0689
27Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10]
28Signed-off-by: Peter Marko <peter.marko@siemens.com>
29---
30 grub-core/fs/affs.c | 9 +++++++--
31 grub-core/fs/cbfs.c | 9 +++++++--
32 grub-core/fs/jfs.c | 9 +++++++--
33 grub-core/fs/minix.c | 9 +++++++--
34 grub-core/fs/nilfs2.c | 9 +++++++--
35 grub-core/fs/ntfs.c | 9 +++++++--
36 grub-core/fs/reiserfs.c | 9 +++++++--
37 grub-core/fs/romfs.c | 9 +++++++--
38 grub-core/fs/sfs.c | 9 +++++++--
39 grub-core/fs/udf.c | 9 +++++++--
40 grub-core/fs/ufs.c | 9 +++++++--
41 11 files changed, 77 insertions(+), 22 deletions(-)
42
43diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
44index ed606b3f1..352f5d232 100644
45--- a/grub-core/fs/affs.c
46+++ b/grub-core/fs/affs.c
47@@ -26,6 +26,7 @@
48 #include <grub/types.h>
49 #include <grub/fshelp.h>
50 #include <grub/charset.h>
51+#include <grub/lockdown.h>
52
53 GRUB_MOD_LICENSE ("GPLv3+");
54
55@@ -703,11 +704,15 @@ static struct grub_fs grub_affs_fs =
56
57 GRUB_MOD_INIT(affs)
58 {
59- grub_fs_register (&grub_affs_fs);
60+ if (!grub_is_lockdown ())
61+ {
62+ grub_fs_register (&grub_affs_fs);
63+ }
64 my_mod = mod;
65 }
66
67 GRUB_MOD_FINI(affs)
68 {
69- grub_fs_unregister (&grub_affs_fs);
70+ if (!grub_is_lockdown ())
71+ grub_fs_unregister (&grub_affs_fs);
72 }
73diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c
74index 8ab7106af..f6349df34 100644
75--- a/grub-core/fs/cbfs.c
76+++ b/grub-core/fs/cbfs.c
77@@ -26,6 +26,7 @@
78 #include <grub/dl.h>
79 #include <grub/i18n.h>
80 #include <grub/cbfs_core.h>
81+#include <grub/lockdown.h>
82
83 GRUB_MOD_LICENSE ("GPLv3+");
84
85@@ -390,12 +391,16 @@ GRUB_MOD_INIT (cbfs)
86 #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
87 init_cbfsdisk ();
88 #endif
89- grub_fs_register (&grub_cbfs_fs);
90+ if (!grub_is_lockdown ())
91+ {
92+ grub_fs_register (&grub_cbfs_fs);
93+ }
94 }
95
96 GRUB_MOD_FINI (cbfs)
97 {
98- grub_fs_unregister (&grub_cbfs_fs);
99+ if (!grub_is_lockdown ())
100+ grub_fs_unregister (&grub_cbfs_fs);
101 #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
102 fini_cbfsdisk ();
103 #endif
104diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
105index 6f7c43904..c0bbab8a9 100644
106--- a/grub-core/fs/jfs.c
107+++ b/grub-core/fs/jfs.c
108@@ -26,6 +26,7 @@
109 #include <grub/types.h>
110 #include <grub/charset.h>
111 #include <grub/i18n.h>
112+#include <grub/lockdown.h>
113
114 GRUB_MOD_LICENSE ("GPLv3+");
115
116@@ -963,11 +964,15 @@ static struct grub_fs grub_jfs_fs =
117
118 GRUB_MOD_INIT(jfs)
119 {
120- grub_fs_register (&grub_jfs_fs);
121+ if (!grub_is_lockdown ())
122+ {
123+ grub_fs_register (&grub_jfs_fs);
124+ }
125 my_mod = mod;
126 }
127
128 GRUB_MOD_FINI(jfs)
129 {
130- grub_fs_unregister (&grub_jfs_fs);
131+ if (!grub_is_lockdown ())
132+ grub_fs_unregister (&grub_jfs_fs);
133 }
134diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c
135index 5354951d1..c267298b5 100644
136--- a/grub-core/fs/minix.c
137+++ b/grub-core/fs/minix.c
138@@ -25,6 +25,7 @@
139 #include <grub/dl.h>
140 #include <grub/types.h>
141 #include <grub/i18n.h>
142+#include <grub/lockdown.h>
143
144 GRUB_MOD_LICENSE ("GPLv3+");
145
146@@ -734,7 +735,10 @@ GRUB_MOD_INIT(minix)
147 #endif
148 #endif
149 {
150- grub_fs_register (&grub_minix_fs);
151+ if (!grub_is_lockdown ())
152+ {
153+ grub_fs_register (&grub_minix_fs);
154+ }
155 my_mod = mod;
156 }
157
158@@ -756,5 +760,6 @@ GRUB_MOD_FINI(minix)
159 #endif
160 #endif
161 {
162- grub_fs_unregister (&grub_minix_fs);
163+ if (!grub_is_lockdown ())
164+ grub_fs_unregister (&grub_minix_fs);
165 }
166diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
167index fc7374ead..08abf173f 100644
168--- a/grub-core/fs/nilfs2.c
169+++ b/grub-core/fs/nilfs2.c
170@@ -34,6 +34,7 @@
171 #include <grub/dl.h>
172 #include <grub/types.h>
173 #include <grub/fshelp.h>
174+#include <grub/lockdown.h>
175
176 GRUB_MOD_LICENSE ("GPLv3+");
177
178@@ -1231,11 +1232,15 @@ GRUB_MOD_INIT (nilfs2)
179 grub_nilfs2_dat_entry));
180 COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE
181 == sizeof (struct grub_nilfs2_inode));
182- grub_fs_register (&grub_nilfs2_fs);
183+ if (!grub_is_lockdown ())
184+ {
185+ grub_fs_register (&grub_nilfs2_fs);
186+ }
187 my_mod = mod;
188 }
189
190 GRUB_MOD_FINI (nilfs2)
191 {
192- grub_fs_unregister (&grub_nilfs2_fs);
193+ if (!grub_is_lockdown ())
194+ grub_fs_unregister (&grub_nilfs2_fs);
195 }
196diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
197index de435aa14..8cc2ba3d5 100644
198--- a/grub-core/fs/ntfs.c
199+++ b/grub-core/fs/ntfs.c
200@@ -27,6 +27,7 @@
201 #include <grub/fshelp.h>
202 #include <grub/ntfs.h>
203 #include <grub/charset.h>
204+#include <grub/lockdown.h>
205
206 GRUB_MOD_LICENSE ("GPLv3+");
207
208@@ -1320,11 +1321,15 @@ static struct grub_fs grub_ntfs_fs =
209
210 GRUB_MOD_INIT (ntfs)
211 {
212- grub_fs_register (&grub_ntfs_fs);
213+ if (!grub_is_lockdown ())
214+ {
215+ grub_fs_register (&grub_ntfs_fs);
216+ }
217 my_mod = mod;
218 }
219
220 GRUB_MOD_FINI (ntfs)
221 {
222- grub_fs_unregister (&grub_ntfs_fs);
223+ if (!grub_is_lockdown ())
224+ grub_fs_unregister (&grub_ntfs_fs);
225 }
226diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c
227index 36b26ac98..cdef2eba0 100644
228--- a/grub-core/fs/reiserfs.c
229+++ b/grub-core/fs/reiserfs.c
230@@ -39,6 +39,7 @@
231 #include <grub/types.h>
232 #include <grub/fshelp.h>
233 #include <grub/i18n.h>
234+#include <grub/lockdown.h>
235
236 GRUB_MOD_LICENSE ("GPLv3+");
237
238@@ -1417,11 +1418,15 @@ static struct grub_fs grub_reiserfs_fs =
239
240 GRUB_MOD_INIT(reiserfs)
241 {
242- grub_fs_register (&grub_reiserfs_fs);
243+ if (!grub_is_lockdown ())
244+ {
245+ grub_fs_register (&grub_reiserfs_fs);
246+ }
247 my_mod = mod;
248 }
249
250 GRUB_MOD_FINI(reiserfs)
251 {
252- grub_fs_unregister (&grub_reiserfs_fs);
253+ if (!grub_is_lockdown ())
254+ grub_fs_unregister (&grub_reiserfs_fs);
255 }
256diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
257index 1f7dcfca1..acf8dd21e 100644
258--- a/grub-core/fs/romfs.c
259+++ b/grub-core/fs/romfs.c
260@@ -23,6 +23,7 @@
261 #include <grub/disk.h>
262 #include <grub/fs.h>
263 #include <grub/fshelp.h>
264+#include <grub/lockdown.h>
265
266 GRUB_MOD_LICENSE ("GPLv3+");
267
268@@ -475,10 +476,14 @@ static struct grub_fs grub_romfs_fs =
269
270 GRUB_MOD_INIT(romfs)
271 {
272- grub_fs_register (&grub_romfs_fs);
273+ if (!grub_is_lockdown ())
274+ {
275+ grub_fs_register (&grub_romfs_fs);
276+ }
277 }
278
279 GRUB_MOD_FINI(romfs)
280 {
281- grub_fs_unregister (&grub_romfs_fs);
282+ if (!grub_is_lockdown ())
283+ grub_fs_unregister (&grub_romfs_fs);
284 }
285diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
286index 983e88008..f64bdd2df 100644
287--- a/grub-core/fs/sfs.c
288+++ b/grub-core/fs/sfs.c
289@@ -26,6 +26,7 @@
290 #include <grub/types.h>
291 #include <grub/fshelp.h>
292 #include <grub/charset.h>
293+#include <grub/lockdown.h>
294 #include <grub/safemath.h>
295
296 GRUB_MOD_LICENSE ("GPLv3+");
297@@ -779,11 +780,15 @@ static struct grub_fs grub_sfs_fs =
298
299 GRUB_MOD_INIT(sfs)
300 {
301- grub_fs_register (&grub_sfs_fs);
302+ if (!grub_is_lockdown ())
303+ {
304+ grub_fs_register (&grub_sfs_fs);
305+ }
306 my_mod = mod;
307 }
308
309 GRUB_MOD_FINI(sfs)
310 {
311- grub_fs_unregister (&grub_sfs_fs);
312+ if (!grub_is_lockdown ())
313+ grub_fs_unregister (&grub_sfs_fs);
314 }
315diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
316index b836e6107..a60643be1 100644
317--- a/grub-core/fs/udf.c
318+++ b/grub-core/fs/udf.c
319@@ -27,6 +27,7 @@
320 #include <grub/fshelp.h>
321 #include <grub/charset.h>
322 #include <grub/datetime.h>
323+#include <grub/lockdown.h>
324 #include <grub/udf.h>
325 #include <grub/safemath.h>
326
327@@ -1455,11 +1456,15 @@ static struct grub_fs grub_udf_fs = {
328
329 GRUB_MOD_INIT (udf)
330 {
331- grub_fs_register (&grub_udf_fs);
332+ if (!grub_is_lockdown ())
333+ {
334+ grub_fs_register (&grub_udf_fs);
335+ }
336 my_mod = mod;
337 }
338
339 GRUB_MOD_FINI (udf)
340 {
341- grub_fs_unregister (&grub_udf_fs);
342+ if (!grub_is_lockdown ())
343+ grub_fs_unregister (&grub_udf_fs);
344 }
345diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
346index 01235101b..6b496e7b8 100644
347--- a/grub-core/fs/ufs.c
348+++ b/grub-core/fs/ufs.c
349@@ -25,6 +25,7 @@
350 #include <grub/dl.h>
351 #include <grub/types.h>
352 #include <grub/i18n.h>
353+#include <grub/lockdown.h>
354
355 GRUB_MOD_LICENSE ("GPLv3+");
356
357@@ -899,7 +900,10 @@ GRUB_MOD_INIT(ufs1)
358 #endif
359 #endif
360 {
361- grub_fs_register (&grub_ufs_fs);
362+ if (!grub_is_lockdown ())
363+ {
364+ grub_fs_register (&grub_ufs_fs);
365+ }
366 my_mod = mod;
367 }
368
369@@ -913,6 +917,7 @@ GRUB_MOD_FINI(ufs1)
370 #endif
371 #endif
372 {
373- grub_fs_unregister (&grub_ufs_fs);
374+ if (!grub_is_lockdown ())
375+ grub_fs_unregister (&grub_ufs_fs);
376 }
377
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index d187ffedc4..a9d55ba015 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -34,6 +34,7 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
34 file://CVE-2025-0690.patch \ 34 file://CVE-2025-0690.patch \
35 file://CVE-2025-1118.patch \ 35 file://CVE-2025-1118.patch \
36 file://CVE-2024-45778_CVE-2024-45779.patch \ 36 file://CVE-2024-45778_CVE-2024-45779.patch \
37 file://CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch \
37" 38"
38 39
39SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91" 40SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-04 16:41:18 +0000