summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch39
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch44
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch41
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0624.patch87
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch380
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch90
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0690.patch75
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-1118.patch40
-rw-r--r--meta/recipes-bsp/grub/grub2.inc8
9 files changed, 804 insertions, 0 deletions
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
new file mode 100644
index 0000000000..9b300c7224
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
@@ -0,0 +1,39 @@
1From 2123c5bca7e21fbeb0263df4597ddd7054700726 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 1 Nov 2024 19:24:29 +0000
4Subject: [PATCH 1/3] commands/pgp: Unregister the "check_signatures" hooks on
5 module unload
6
7If the hooks are not removed they can be called after the module has
8been unloaded leading to an use-after-free.
9
10Fixes: CVE-2025-0622
11
12Reported-by: B Horn <b@horn.uk>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2025-0622
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2123c5bca7e21fbeb0263df4597ddd7054700726]
18
19Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
20---
21 grub-core/commands/pgp.c | 2 ++
22 1 file changed, 2 insertions(+)
23
24diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
25index 5daa1e9..1abdea6 100644
26--- a/grub-core/commands/pgp.c
27+++ b/grub-core/commands/pgp.c
28@@ -1010,6 +1010,8 @@ GRUB_MOD_INIT(pgp)
29
30 GRUB_MOD_FINI(pgp)
31 {
32+ grub_register_variable_hook ("check_signatures", NULL, NULL);
33+ grub_env_unset ("check_signatures");
34 grub_verifier_unregister (&grub_pubkey_verifier);
35 grub_unregister_extcmd (cmd);
36 grub_unregister_extcmd (cmd_trust);
37--
382.25.1
39
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
new file mode 100644
index 0000000000..17800dd7c4
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
@@ -0,0 +1,44 @@
1From 9c16197734ada8d0838407eebe081117799bfe67 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 1 Nov 2024 23:46:55 +0000
4Subject: [PATCH 2/3] normal: Remove variables hooks on module unload
5
6The normal module does not entirely cleanup after itself in
7its GRUB_MOD_FINI() leaving a few variables hooks in place.
8It is not possible to unload normal module now but fix the
9issues for completeness.
10
11On the occasion replace 0s with NULLs for "pager" variable
12hooks unregister.
13
14Fixes: CVE-2025-0622
15
16Reported-by: B Horn <b@horn.uk>
17Signed-off-by: B Horn <b@horn.uk>
18Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
19
20CVE: CVE-2025-0622
21Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c16197734ada8d0838407eebe081117799bfe67]
22Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
23---
24 grub-core/normal/main.c | 4 +++-
25 1 file changed, 3 insertions(+), 1 deletion(-)
26
27diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
28index c4ebe9e..31c53a6 100644
29--- a/grub-core/normal/main.c
30+++ b/grub-core/normal/main.c
31@@ -581,7 +581,9 @@ GRUB_MOD_FINI(normal)
32 grub_xputs = grub_xputs_saved;
33
34 grub_set_history (0);
35- grub_register_variable_hook ("pager", 0, 0);
36+ grub_register_variable_hook ("pager", NULL, NULL);
37+ grub_register_variable_hook ("color_normal", NULL, NULL);
38+ grub_register_variable_hook ("color_highlight", NULL, NULL);
39 grub_fs_autoload_hook = 0;
40 grub_unregister_command (cmd_clear);
41 }
42--
432.25.1
44
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
new file mode 100644
index 0000000000..c3147cdb1f
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
@@ -0,0 +1,41 @@
1From 7580addfc8c94cedb0cdfd7a1fd65b539215e637 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 1 Nov 2024 23:52:06 +0000
4Subject: [PATCH 3/3] gettext: Remove variables hooks on module unload
5
6The gettext module does not entirely cleanup after itself in
7its GRUB_MOD_FINI() leaving a few variables hooks in place.
8It is not possible to unload gettext module because normal
9module depends on it. Though fix the issues for completeness.
10
11Fixes: CVE-2025-0622
12
13Reported-by: B Horn <b@horn.uk>
14Signed-off-by: B Horn <b@horn.uk>
15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
16
17CVE: CVE-2025-0622
18Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637]
19Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
20---
21 grub-core/gettext/gettext.c | 4 ++++
22 1 file changed, 4 insertions(+)
23
24diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
25index 85ea44a..7a25c9d 100644
26--- a/grub-core/gettext/gettext.c
27+++ b/grub-core/gettext/gettext.c
28@@ -540,6 +540,10 @@ GRUB_MOD_INIT (gettext)
29
30 GRUB_MOD_FINI (gettext)
31 {
32+ grub_register_variable_hook ("locale_dir", NULL, NULL);
33+ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
34+ grub_register_variable_hook ("lang", NULL, NULL);
35+
36 grub_gettext_delete_list (&main_context);
37 grub_gettext_delete_list (&secondary_context);
38
39--
402.25.1
41
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0624.patch b/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
new file mode 100644
index 0000000000..02f270a033
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
@@ -0,0 +1,87 @@
1From 5eef88152833062a3f7e017535372d64ac8ef7e1 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 15 Nov 2024 13:12:09 +0000
4Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file()
5
6The function included a call to grub_strcpy() which copied data from an
7environment variable to a buffer allocated in grub_cmd_normal(). The
8grub_cmd_normal() didn't consider the length of the environment variable.
9So, the copy operation could exceed the allocation and lead to an OOB
10write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and
11pass the underlying buffers size to the grub_net_search_config_file().
12
13Fixes: CVE-2025-0624
14
15Reported-by: B Horn <b@horn.uk>
16Signed-off-by: B Horn <b@horn.uk>
17Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
18
19CVE: CVE-2025-0624
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5eef88152833062a3f7e017535372d64ac8ef7e1]
21Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
22---
23 grub-core/net/net.c | 7 ++++---
24 grub-core/normal/main.c | 2 +-
25 include/grub/net.h | 2 +-
26 3 files changed, 6 insertions(+), 5 deletions(-)
27
28diff --git a/grub-core/net/net.c b/grub-core/net/net.c
29index 4d3eb5c..ec7f01c 100644
30--- a/grub-core/net/net.c
31+++ b/grub-core/net/net.c
32@@ -1773,14 +1773,15 @@ grub_config_search_through (char *config, char *suffix,
33 }
34
35 grub_err_t
36-grub_net_search_config_file (char *config)
37+grub_net_search_config_file (char *config, grub_size_t config_buf_len)
38 {
39- grub_size_t config_len;
40+ grub_size_t config_len, suffix_len;
41 char *suffix;
42
43 config_len = grub_strlen (config);
44 config[config_len] = '-';
45 suffix = config + config_len + 1;
46+ suffix_len = config_buf_len - (config_len + 1);
47
48 struct grub_net_network_level_interface *inf;
49 FOR_NET_NETWORK_LEVEL_INTERFACES (inf)
50@@ -1806,7 +1807,7 @@ grub_net_search_config_file (char *config)
51
52 if (client_uuid)
53 {
54- grub_strcpy (suffix, client_uuid);
55+ grub_strlcpy (suffix, client_uuid, suffix_len);
56 if (grub_config_search_through (config, suffix, 1, 0) == 0)
57 return GRUB_ERR_NONE;
58 }
59diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
60index 31c53a6..a95c25e 100644
61--- a/grub-core/normal/main.c
62+++ b/grub-core/normal/main.c
63@@ -344,7 +344,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)),
64
65 if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 &&
66 !disable_net_search)
67- grub_net_search_config_file (config);
68+ grub_net_search_config_file (config, config_len);
69
70 grub_enter_normal_mode (config);
71 grub_free (config);
72diff --git a/include/grub/net.h b/include/grub/net.h
73index 7ae4b6b..d6ba8b1 100644
74--- a/include/grub/net.h
75+++ b/include/grub/net.h
76@@ -570,7 +570,7 @@ void
77 grub_net_remove_dns_server (const struct grub_net_network_level_address *s);
78
79 grub_err_t
80-grub_net_search_config_file (char *config);
81+grub_net_search_config_file (char *config, grub_size_t config_buf_len);
82
83 extern char *grub_net_default_server;
84
85--
862.25.1
87
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
new file mode 100644
index 0000000000..f955611d9d
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
@@ -0,0 +1,380 @@
1From 47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10 Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Sat, 23 Mar 2024 16:20:45 +1100
4Subject: [PATCH] fs: Disable many filesystems under lockdown
5
6The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat,
7hfsplus, iso9660, squash4, tar, xfs and zfs.
8
9The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were
10reported by Jonathan Bar Or <jonathanbaror@gmail.com>.
11
12Fixes: CVE-2025-0677
13Fixes: CVE-2025-0684
14Fixes: CVE-2025-0685
15Fixes: CVE-2025-0686
16Fixes: CVE-2025-0689
17
18Suggested-by: Daniel Axtens <dja@axtens.net>
19Signed-off-by: Daniel Axtens <dja@axtens.net>
20Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
21
22CVE: CVE-2025-0677
23CVE: CVE-2025-0684
24CVE: CVE-2025-0685
25CVE: CVE-2025-0686
26CVE: CVE-2025-0689
27Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10]
28Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
29---
30 grub-core/fs/affs.c | 9 +++++++--
31 grub-core/fs/cbfs.c | 9 +++++++--
32 grub-core/fs/jfs.c | 9 +++++++--
33 grub-core/fs/minix.c | 9 +++++++--
34 grub-core/fs/nilfs2.c | 9 +++++++--
35 grub-core/fs/ntfs.c | 9 +++++++--
36 grub-core/fs/reiserfs.c | 9 +++++++--
37 grub-core/fs/romfs.c | 9 +++++++--
38 grub-core/fs/sfs.c | 9 +++++++--
39 grub-core/fs/udf.c | 9 +++++++--
40 grub-core/fs/ufs.c | 9 +++++++--
41 11 files changed, 77 insertions(+), 22 deletions(-)
42
43diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
44index cafcd0f..d676532 100644
45--- a/grub-core/fs/affs.c
46+++ b/grub-core/fs/affs.c
47@@ -26,6 +26,7 @@
48 #include <grub/types.h>
49 #include <grub/fshelp.h>
50 #include <grub/charset.h>
51+#include <grub/lockdown.h>
52
53 GRUB_MOD_LICENSE ("GPLv3+");
54
55@@ -699,11 +700,15 @@ static struct grub_fs grub_affs_fs =
56
57 GRUB_MOD_INIT(affs)
58 {
59- grub_fs_register (&grub_affs_fs);
60+ if (!grub_is_lockdown ())
61+ {
62+ grub_fs_register (&grub_affs_fs);
63+ }
64 my_mod = mod;
65 }
66
67 GRUB_MOD_FINI(affs)
68 {
69- grub_fs_unregister (&grub_affs_fs);
70+ if (!grub_is_lockdown ())
71+ grub_fs_unregister (&grub_affs_fs);
72 }
73diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c
74index 581215e..477a14e 100644
75--- a/grub-core/fs/cbfs.c
76+++ b/grub-core/fs/cbfs.c
77@@ -26,6 +26,7 @@
78 #include <grub/dl.h>
79 #include <grub/i18n.h>
80 #include <grub/cbfs_core.h>
81+#include <grub/lockdown.h>
82
83 GRUB_MOD_LICENSE ("GPLv3+");
84
85@@ -390,12 +391,16 @@ GRUB_MOD_INIT (cbfs)
86 #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
87 init_cbfsdisk ();
88 #endif
89- grub_fs_register (&grub_cbfs_fs);
90+ if (!grub_is_lockdown ())
91+ {
92+ grub_fs_register (&grub_cbfs_fs);
93+ }
94 }
95
96 GRUB_MOD_FINI (cbfs)
97 {
98- grub_fs_unregister (&grub_cbfs_fs);
99+ if (!grub_is_lockdown ())
100+ grub_fs_unregister (&grub_cbfs_fs);
101 #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
102 fini_cbfsdisk ();
103 #endif
104diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
105index 6f7c439..c0bbab8 100644
106--- a/grub-core/fs/jfs.c
107+++ b/grub-core/fs/jfs.c
108@@ -26,6 +26,7 @@
109 #include <grub/types.h>
110 #include <grub/charset.h>
111 #include <grub/i18n.h>
112+#include <grub/lockdown.h>
113
114 GRUB_MOD_LICENSE ("GPLv3+");
115
116@@ -963,11 +964,15 @@ static struct grub_fs grub_jfs_fs =
117
118 GRUB_MOD_INIT(jfs)
119 {
120- grub_fs_register (&grub_jfs_fs);
121+ if (!grub_is_lockdown ())
122+ {
123+ grub_fs_register (&grub_jfs_fs);
124+ }
125 my_mod = mod;
126 }
127
128 GRUB_MOD_FINI(jfs)
129 {
130- grub_fs_unregister (&grub_jfs_fs);
131+ if (!grub_is_lockdown ())
132+ grub_fs_unregister (&grub_jfs_fs);
133 }
134diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c
135index 3cd18c8..7588835 100644
136--- a/grub-core/fs/minix.c
137+++ b/grub-core/fs/minix.c
138@@ -25,6 +25,7 @@
139 #include <grub/dl.h>
140 #include <grub/types.h>
141 #include <grub/i18n.h>
142+#include <grub/lockdown.h>
143
144 GRUB_MOD_LICENSE ("GPLv3+");
145
146@@ -732,7 +733,10 @@ GRUB_MOD_INIT(minix)
147 #endif
148 #endif
149 {
150- grub_fs_register (&grub_minix_fs);
151+ if (!grub_is_lockdown ())
152+ {
153+ grub_fs_register (&grub_minix_fs);
154+ }
155 my_mod = mod;
156 }
157
158@@ -754,5 +758,6 @@ GRUB_MOD_FINI(minix)
159 #endif
160 #endif
161 {
162- grub_fs_unregister (&grub_minix_fs);
163+ if (!grub_is_lockdown ())
164+ grub_fs_unregister (&grub_minix_fs);
165 }
166diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
167index 3c248a9..3f8e495 100644
168--- a/grub-core/fs/nilfs2.c
169+++ b/grub-core/fs/nilfs2.c
170@@ -34,6 +34,7 @@
171 #include <grub/dl.h>
172 #include <grub/types.h>
173 #include <grub/fshelp.h>
174+#include <grub/lockdown.h>
175
176 GRUB_MOD_LICENSE ("GPLv3+");
177
178@@ -1231,11 +1232,15 @@ GRUB_MOD_INIT (nilfs2)
179 grub_nilfs2_dat_entry));
180 COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE
181 == sizeof (struct grub_nilfs2_inode));
182- grub_fs_register (&grub_nilfs2_fs);
183+ if (!grub_is_lockdown ())
184+ {
185+ grub_fs_register (&grub_nilfs2_fs);
186+ }
187 my_mod = mod;
188 }
189
190 GRUB_MOD_FINI (nilfs2)
191 {
192- grub_fs_unregister (&grub_nilfs2_fs);
193+ if (!grub_is_lockdown ())
194+ grub_fs_unregister (&grub_nilfs2_fs);
195 }
196diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
197index 8f63c83..713e24d 100644
198--- a/grub-core/fs/ntfs.c
199+++ b/grub-core/fs/ntfs.c
200@@ -27,6 +27,7 @@
201 #include <grub/fshelp.h>
202 #include <grub/ntfs.h>
203 #include <grub/charset.h>
204+#include <grub/lockdown.h>
205
206 GRUB_MOD_LICENSE ("GPLv3+");
207
208@@ -1254,11 +1255,15 @@ static struct grub_fs grub_ntfs_fs =
209
210 GRUB_MOD_INIT (ntfs)
211 {
212- grub_fs_register (&grub_ntfs_fs);
213+ if (!grub_is_lockdown ())
214+ {
215+ grub_fs_register (&grub_ntfs_fs);
216+ }
217 my_mod = mod;
218 }
219
220 GRUB_MOD_FINI (ntfs)
221 {
222- grub_fs_unregister (&grub_ntfs_fs);
223+ if (!grub_is_lockdown ())
224+ grub_fs_unregister (&grub_ntfs_fs);
225 }
226diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c
227index af6a226..76cb231 100644
228--- a/grub-core/fs/reiserfs.c
229+++ b/grub-core/fs/reiserfs.c
230@@ -39,6 +39,7 @@
231 #include <grub/types.h>
232 #include <grub/fshelp.h>
233 #include <grub/i18n.h>
234+#include <grub/lockdown.h>
235
236 GRUB_MOD_LICENSE ("GPLv3+");
237
238@@ -1417,11 +1418,15 @@ static struct grub_fs grub_reiserfs_fs =
239
240 GRUB_MOD_INIT(reiserfs)
241 {
242- grub_fs_register (&grub_reiserfs_fs);
243+ if (!grub_is_lockdown ())
244+ {
245+ grub_fs_register (&grub_reiserfs_fs);
246+ }
247 my_mod = mod;
248 }
249
250 GRUB_MOD_FINI(reiserfs)
251 {
252- grub_fs_unregister (&grub_reiserfs_fs);
253+ if (!grub_is_lockdown ())
254+ grub_fs_unregister (&grub_reiserfs_fs);
255 }
256diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
257index d97b8fb..d174449 100644
258--- a/grub-core/fs/romfs.c
259+++ b/grub-core/fs/romfs.c
260@@ -23,6 +23,7 @@
261 #include <grub/disk.h>
262 #include <grub/fs.h>
263 #include <grub/fshelp.h>
264+#include <grub/lockdown.h>
265
266 GRUB_MOD_LICENSE ("GPLv3+");
267
268@@ -475,10 +476,14 @@ static struct grub_fs grub_romfs_fs =
269
270 GRUB_MOD_INIT(romfs)
271 {
272- grub_fs_register (&grub_romfs_fs);
273+ if (!grub_is_lockdown ())
274+ {
275+ grub_fs_register (&grub_romfs_fs);
276+ }
277 }
278
279 GRUB_MOD_FINI(romfs)
280 {
281- grub_fs_unregister (&grub_romfs_fs);
282+ if (!grub_is_lockdown ())
283+ grub_fs_unregister (&grub_romfs_fs);
284 }
285diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
286index 983e880..f64bdd2 100644
287--- a/grub-core/fs/sfs.c
288+++ b/grub-core/fs/sfs.c
289@@ -26,6 +26,7 @@
290 #include <grub/types.h>
291 #include <grub/fshelp.h>
292 #include <grub/charset.h>
293+#include <grub/lockdown.h>
294 #include <grub/safemath.h>
295
296 GRUB_MOD_LICENSE ("GPLv3+");
297@@ -779,11 +780,15 @@ static struct grub_fs grub_sfs_fs =
298
299 GRUB_MOD_INIT(sfs)
300 {
301- grub_fs_register (&grub_sfs_fs);
302+ if (!grub_is_lockdown ())
303+ {
304+ grub_fs_register (&grub_sfs_fs);
305+ }
306 my_mod = mod;
307 }
308
309 GRUB_MOD_FINI(sfs)
310 {
311- grub_fs_unregister (&grub_sfs_fs);
312+ if (!grub_is_lockdown ())
313+ grub_fs_unregister (&grub_sfs_fs);
314 }
315diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
316index 2ac5c1d..f89c6b0 100644
317--- a/grub-core/fs/udf.c
318+++ b/grub-core/fs/udf.c
319@@ -27,6 +27,7 @@
320 #include <grub/fshelp.h>
321 #include <grub/charset.h>
322 #include <grub/datetime.h>
323+#include <grub/lockdown.h>
324 #include <grub/udf.h>
325 #include <grub/safemath.h>
326
327@@ -1382,11 +1383,15 @@ static struct grub_fs grub_udf_fs = {
328
329 GRUB_MOD_INIT (udf)
330 {
331- grub_fs_register (&grub_udf_fs);
332+ if (!grub_is_lockdown ())
333+ {
334+ grub_fs_register (&grub_udf_fs);
335+ }
336 my_mod = mod;
337 }
338
339 GRUB_MOD_FINI (udf)
340 {
341- grub_fs_unregister (&grub_udf_fs);
342+ if (!grub_is_lockdown ())
343+ grub_fs_unregister (&grub_udf_fs);
344 }
345diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
346index 4727266..90fda07 100644
347--- a/grub-core/fs/ufs.c
348+++ b/grub-core/fs/ufs.c
349@@ -25,6 +25,7 @@
350 #include <grub/dl.h>
351 #include <grub/types.h>
352 #include <grub/i18n.h>
353+#include <grub/lockdown.h>
354
355 GRUB_MOD_LICENSE ("GPLv3+");
356
357@@ -899,7 +900,10 @@ GRUB_MOD_INIT(ufs1)
358 #endif
359 #endif
360 {
361- grub_fs_register (&grub_ufs_fs);
362+ if (!grub_is_lockdown ())
363+ {
364+ grub_fs_register (&grub_ufs_fs);
365+ }
366 my_mod = mod;
367 }
368
369@@ -913,6 +917,7 @@ GRUB_MOD_FINI(ufs1)
370 #endif
371 #endif
372 {
373- grub_fs_unregister (&grub_ufs_fs);
374+ if (!grub_is_lockdown ())
375+ grub_fs_unregister (&grub_ufs_fs);
376 }
377
378--
3792.25.1
380
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch b/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
new file mode 100644
index 0000000000..5e06a64969
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
@@ -0,0 +1,90 @@
1From 84bc0a9a68835952ae69165c11709811dae7634e Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Tue, 21 Jan 2025 19:02:37 +0000
4Subject: [PATCH] fs: Prevent overflows when allocating memory for arrays
5
6Use grub_calloc() when allocating memory for arrays to ensure proper
7overflow checks are in place.
8
9The HFS+ and squash4 security vulnerabilities were reported by
10Jonathan Bar Or <jonathanbaror@gmail.com>.
11
12Fixes: CVE-2025-0678
13Fixes: CVE-2025-1125
14
15Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17
18CVE: CVE-2025-0678
19CVE: CVE-2025-1125
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=84bc0a9a68835952ae69165c11709811dae7634e]
21Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
22---
23 grub-core/fs/btrfs.c | 4 ++--
24 grub-core/fs/hfspluscomp.c | 9 +++++++--
25 grub-core/fs/squash4.c | 8 ++++----
26 3 files changed, 13 insertions(+), 8 deletions(-)
27
28diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
29index 6320303..3b8b2f0 100644
30--- a/grub-core/fs/btrfs.c
31+++ b/grub-core/fs/btrfs.c
32@@ -1197,8 +1197,8 @@ grub_btrfs_mount (grub_device_t dev)
33 }
34
35 data->n_devices_allocated = 16;
36- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0])
37- * data->n_devices_allocated);
38+ data->devices_attached = grub_calloc (data->n_devices_allocated,
39+ sizeof (data->devices_attached[0]));
40 if (!data->devices_attached)
41 {
42 grub_free (data);
43diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c
44index d76f3f1..4965ef1 100644
45--- a/grub-core/fs/hfspluscomp.c
46+++ b/grub-core/fs/hfspluscomp.c
47@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node)
48 return 0;
49 }
50 node->compress_index_size = grub_le_to_cpu32 (index_size);
51- node->compress_index = grub_malloc (node->compress_index_size
52- * sizeof (node->compress_index[0]));
53+ node->compress_index = grub_calloc (node->compress_index_size,
54+ sizeof (node->compress_index[0]));
55 if (!node->compress_index)
56 {
57 node->compressed = 0;
58 grub_free (attr_node);
59 return grub_errno;
60 }
61+
62+ /*
63+ * The node->compress_index_size * sizeof (node->compress_index[0]) is safe here
64+ * due to relevant checks done in grub_calloc() above.
65+ */
66 if (grub_hfsplus_read_file (node, 0, 0,
67 0x104 + sizeof (index_size),
68 node->compress_index_size
69diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
70index 6dd731e..f79fc75 100644
71--- a/grub-core/fs/squash4.c
72+++ b/grub-core/fs/squash4.c
73@@ -804,10 +804,10 @@ direct_read (struct grub_squash_data *data,
74 break;
75 }
76 total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz);
77- ino->block_sizes = grub_malloc (total_blocks
78- * sizeof (ino->block_sizes[0]));
79- ino->cumulated_block_sizes = grub_malloc (total_blocks
80- * sizeof (ino->cumulated_block_sizes[0]));
81+ ino->block_sizes = grub_calloc (total_blocks,
82+ sizeof (ino->block_sizes[0]));
83+ ino->cumulated_block_sizes = grub_calloc (total_blocks,
84+ sizeof (ino->cumulated_block_sizes[0]));
85 if (!ino->block_sizes || !ino->cumulated_block_sizes)
86 {
87 grub_free (ino->block_sizes);
88--
892.25.1
90
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0690.patch b/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
new file mode 100644
index 0000000000..9a2ca50d02
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
@@ -0,0 +1,75 @@
1From dad8f502974ed9ad0a70ae6820d17b4b142558fc Mon Sep 17 00:00:00 2001
2From: Jonathan Bar Or <jonathanbaror@gmail.com>
3Date: Thu, 23 Jan 2025 19:17:05 +0100
4Subject: [PATCH] commands/read: Fix an integer overflow when supplying more
5 than 2^31 characters
6
7The grub_getline() function currently has a signed integer variable "i"
8that can be overflown when user supplies more than 2^31 characters.
9It results in a memory corruption of the allocated line buffer as well
10as supplying large negative values to grub_realloc().
11
12Fixes: CVE-2025-0690
13
14Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
15Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17
18CVE: CVE-2025-0690
19Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc]
20Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
21---
22 grub-core/commands/read.c | 19 +++++++++++++++----
23 1 file changed, 15 insertions(+), 4 deletions(-)
24
25diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c
26index fe3e88b..f3ff826 100644
27--- a/grub-core/commands/read.c
28+++ b/grub-core/commands/read.c
29@@ -25,19 +25,21 @@
30 #include <grub/types.h>
31 #include <grub/command.h>
32 #include <grub/i18n.h>
33+#include <grub/safemath.h>
34
35 GRUB_MOD_LICENSE ("GPLv3+");
36
37 static char *
38 grub_getline (void)
39 {
40- int i;
41+ grub_size_t i;
42 char *line;
43 char *tmp;
44 char c;
45+ grub_size_t alloc_size;
46
47 i = 0;
48- line = grub_malloc (1 + i + sizeof('\0'));
49+ line = grub_malloc (1 + sizeof('\0'));
50 if (! line)
51 return NULL;
52
53@@ -50,8 +52,17 @@ grub_getline (void)
54 line[i] = c;
55 if (grub_isprint (c))
56 grub_printf ("%c", c);
57- i++;
58- tmp = grub_realloc (line, 1 + i + sizeof('\0'));
59+ if (grub_add (i, 1, &i))
60+ {
61+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
62+ return NULL;
63+ }
64+ if (grub_add (i, 1 + sizeof('\0'), &alloc_size))
65+ {
66+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
67+ return NULL;
68+ }
69+ tmp = grub_realloc (line, alloc_size);
70 if (! tmp)
71 {
72 grub_free (line);
73--
742.25.1
75
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-1118.patch b/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
new file mode 100644
index 0000000000..e26b5c8752
--- /dev/null
+++ b/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
@@ -0,0 +1,40 @@
1From 34824806ac6302f91e8cabaa41308eaced25725f Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Thu, 18 Apr 2024 20:29:39 +0100
4Subject: [PATCH] commands/minicmd: Block the dump command in lockdown mode
5
6The dump enables a user to read memory which should not be possible
7in lockdown mode.
8
9Fixes: CVE-2025-1118
10
11Reported-by: B Horn <b@horn.uk>
12Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2025-1118
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f]
18Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
19---
20 grub-core/commands/minicmd.c | 4 ++--
21 1 file changed, 2 insertions(+), 2 deletions(-)
22
23diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
24index fa49893..903af33 100644
25--- a/grub-core/commands/minicmd.c
26+++ b/grub-core/commands/minicmd.c
27@@ -203,8 +203,8 @@ GRUB_MOD_INIT(minicmd)
28 grub_register_command ("help", grub_mini_cmd_help,
29 0, N_("Show this message."));
30 cmd_dump =
31- grub_register_command ("dump", grub_mini_cmd_dump,
32- N_("ADDR [SIZE]"), N_("Show memory contents."));
33+ grub_register_command_lockdown ("dump", grub_mini_cmd_dump,
34+ N_("ADDR [SIZE]"), N_("Show memory contents."));
35 cmd_rmmod =
36 grub_register_command ("rmmod", grub_mini_cmd_rmmod,
37 N_("MODULE"), N_("Remove a module."));
38--
392.25.1
40
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
index 259a0a4c3d..cb61080aeb 100644
--- a/meta/recipes-bsp/grub/grub2.inc
+++ b/meta/recipes-bsp/grub/grub2.inc
@@ -51,6 +51,14 @@ SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
51 file://CVE-2024-45781.patch \ 51 file://CVE-2024-45781.patch \
52 file://CVE-2024-45782_CVE-2024-56737.patch \ 52 file://CVE-2024-45782_CVE-2024-56737.patch \
53 file://CVE-2024-45783.patch \ 53 file://CVE-2024-45783.patch \
54 file://CVE-2025-0622-01.patch \
55 file://CVE-2025-0622-02.patch \
56 file://CVE-2025-0622-03.patch \
57 file://CVE-2025-0624.patch \
58 file://CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch \
59 file://CVE-2025-0678_CVE-2025-1125.patch \
60 file://CVE-2025-0690.patch \
61 file://CVE-2025-1118.patch \
54" 62"
55 63
56SRC_URI[sha256sum] = "23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f" 64SRC_URI[sha256sum] = "23b64b4c741569f9426ed2e3d0e6780796fca081bee4c99f62aa3f53ae803f5f"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-07 20:57:51 +0000