summaryrefslogtreecommitdiffstats
path: root/meta/recipes-bsp/grub
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-bsp/grub')
-rw-r--r--meta/recipes-bsp/grub/files/0001-RISC-V-Restore-the-typcast-to-long.patch37
-rw-r--r--meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch54
-rw-r--r--meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch68
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45774.patch37
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45775.patch38
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45776.patch39
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45777.patch57
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch55
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45780.patch93
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45781.patch35
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch36
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-45783.patch39
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2024-56738.patch75
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch35
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch41
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch38
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0624.patch84
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch377
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch87
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-0690.patch73
-rw-r--r--meta/recipes-bsp/grub/files/CVE-2025-1118.patch37
-rw-r--r--meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch34
-rw-r--r--meta/recipes-bsp/grub/files/cfg2
-rw-r--r--meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch60
-rw-r--r--meta/recipes-bsp/grub/grub-bootconf_1.00.bb32
-rw-r--r--meta/recipes-bsp/grub/grub-efi_2.12.bb110
-rw-r--r--meta/recipes-bsp/grub/grub2.inc115
-rw-r--r--meta/recipes-bsp/grub/grub_2.12.bb41
28 files changed, 0 insertions, 1829 deletions
diff --git a/meta/recipes-bsp/grub/files/0001-RISC-V-Restore-the-typcast-to-long.patch b/meta/recipes-bsp/grub/files/0001-RISC-V-Restore-the-typcast-to-long.patch
deleted file mode 100644
index cafa711731..0000000000
--- a/meta/recipes-bsp/grub/files/0001-RISC-V-Restore-the-typcast-to-long.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1From b47029e8e582d17c6874d2622fe1a5b834377dbb Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com>
3Date: Fri, 26 Mar 2021 11:59:43 -0700
4Subject: [PATCH] RISC-V: Restore the typcast to 64bit type
5
6this makes the type promotions clear and explicit
7It was already typecasted to long but was accidentally dropped in [1]
8which stated to cause failures on riscv32 as reported in [2]
9
10[1] https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2bf40e9e5be9808b17852e688eead87acff14420
11[2] https://savannah.gnu.org/bugs/index.php?60283
12
13Upstream-Status: Submitted
14Signed-off-by: Khem Raj <raj.khem@gmail.com>
15Cc: Andreas Schwab <schwab@suse.de>
16Cc: Daniel Kiper <daniel.kiper@oracle.com>
17Cc: Chester Lin <clin@suse.com>
18Cc: Nikita Ermakov <arei@altlinux.org>
19Cc: Alistair Francis <alistair.francis@wdc.com>
20
21---
22 util/grub-mkimagexx.c | 2 +-
23 1 file changed, 1 insertion(+), 1 deletion(-)
24
25diff --git a/util/grub-mkimagexx.c b/util/grub-mkimagexx.c
26index e50b295..2f09255 100644
27--- a/util/grub-mkimagexx.c
28+++ b/util/grub-mkimagexx.c
29@@ -1310,7 +1310,7 @@ SUFFIX (relocate_addrs) (Elf_Ehdr *e, struct section_metadata *smd,
30 */
31
32 sym_addr += addend;
33- off = sym_addr - target_section_addr - offset - image_target->vaddr_offset;
34+ off = (grub_int64_t)sym_addr - target_section_addr - offset - image_target->vaddr_offset;
35
36 switch (ELF_R_TYPE (info))
37 {
diff --git a/meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch b/meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch
deleted file mode 100644
index 69dec7695a..0000000000
--- a/meta/recipes-bsp/grub/files/0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch
+++ /dev/null
@@ -1,54 +0,0 @@
1From a80592e20f6c4b928a22862f52f268ab9d9908b2 Mon Sep 17 00:00:00 2001
2From: Khem Raj <raj.khem@gmail.com>
3Date: Wed, 13 Jan 2016 19:28:00 +0000
4Subject: [PATCH] grub.d/10_linux.in: add oe's kernel name
5
6Our kernel's name is bzImage, we need add it to grub.d/10_linux.in so
7that the grub-mkconfig and grub-install can work correctly.
8
9We only need add the bzImage to util/grub.d/10_linux.in, but also add it
10to util/grub.d/20_linux_xen.in to keep compatibility.
11
12Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
13Signed-off-by: Khem Raj <raj.khem@gmail.com>
14
15Upstream-Status: Inappropriate [OE specific]
16
17---
18 util/grub.d/10_linux.in | 6 +++---
19 util/grub.d/20_linux_xen.in | 2 +-
20 2 files changed, 4 insertions(+), 4 deletions(-)
21
22diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in
23index cc393be..8545cb6 100644
24--- a/util/grub.d/10_linux.in
25+++ b/util/grub.d/10_linux.in
26@@ -166,12 +166,12 @@ machine=`uname -m`
27 case "x$machine" in
28 xi?86 | xx86_64)
29 list=
30- for i in /boot/vmlinuz-* /vmlinuz-* /boot/kernel-* ; do
31+ for i in /boot/bzImage-* /bzImage-* /boot/vmlinuz-* /vmlinuz-* /boot/kernel-* ; do
32 if grub_file_is_not_garbage "$i" ; then list="$list $i" ; fi
33 done ;;
34- *)
35+ *)
36 list=
37- for i in /boot/vmlinuz-* /boot/vmlinux-* /vmlinuz-* /vmlinux-* /boot/kernel-* ; do
38+ for i in /boot/bzImage-* /boot/vmlinuz-* /boot/vmlinux-* /bzImage-* /vmlinuz-* /vmlinux-* /boot/kernel-* ; do
39 if grub_file_is_not_garbage "$i" ; then list="$list $i" ; fi
40 done ;;
41 esac
42diff --git a/util/grub.d/20_linux_xen.in b/util/grub.d/20_linux_xen.in
43index 94dd8be..36cd554 100644
44--- a/util/grub.d/20_linux_xen.in
45+++ b/util/grub.d/20_linux_xen.in
46@@ -181,7 +181,7 @@ EOF
47 }
48
49 linux_list=
50-for i in /boot/vmlinu[xz]-* /vmlinu[xz]-* /boot/kernel-*; do
51+for i in /boot/bzImage[xz]-* /bzImage[xz]-* /boot/vmlinu[xz]-* /vmlinu[xz]-* /boot/kernel-*; do
52 if grub_file_is_not_garbage "$i"; then
53 basename=$(basename $i)
54 version=$(echo $basename | sed -e "s,^[^0-9]*-,,g")
diff --git a/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch b/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
deleted file mode 100644
index 0ff6dff33a..0000000000
--- a/meta/recipes-bsp/grub/files/0001-misc-Implement-grub_strlcpy.patch
+++ /dev/null
@@ -1,68 +0,0 @@
1From ea703528a8581a2ea7e0bad424a70fdf0aec7d8f Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sat, 15 Jun 2024 02:33:08 +0100
4Subject: [PATCH 1/2] misc: Implement grub_strlcpy()
5
6grub_strlcpy() acts the same way as strlcpy() does on most *NIX,
7returning the length of src and ensuring dest is always NUL
8terminated except when size is 0.
9
10Signed-off-by: B Horn <b@horn.uk>
11Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
12
13Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=ea703528a8581a2ea7e0bad424a70fdf0aec7d8f]
14Signed-off-by: Peter Marko <peter.marko@siemens.com>
15---
16 include/grub/misc.h | 39 +++++++++++++++++++++++++++++++++++++++
17 1 file changed, 39 insertions(+)
18
19diff --git a/include/grub/misc.h b/include/grub/misc.h
20index 1578f36c3..14d8f37ac 100644
21--- a/include/grub/misc.h
22+++ b/include/grub/misc.h
23@@ -64,6 +64,45 @@ grub_stpcpy (char *dest, const char *src)
24 return d - 1;
25 }
26
27+static inline grub_size_t
28+grub_strlcpy (char *dest, const char *src, grub_size_t size)
29+{
30+ char *d = dest;
31+ grub_size_t res = 0;
32+ /*
33+ * We do not subtract one from size here to avoid dealing with underflowing
34+ * the value, which is why to_copy is always checked to be greater than one
35+ * throughout this function.
36+ */
37+ grub_size_t to_copy = size;
38+
39+ /* Copy size - 1 bytes to dest. */
40+ if (to_copy > 1)
41+ while ((*d++ = *src++) != '\0' && ++res && --to_copy > 1)
42+ ;
43+
44+ /*
45+ * NUL terminate if size != 0. The previous step may have copied a NUL byte
46+ * if it reached the end of the string, but we know dest[size - 1] must always
47+ * be a NUL byte.
48+ */
49+ if (size != 0)
50+ dest[size - 1] = '\0';
51+
52+ /* If there is still space in dest, but are here, we reached the end of src. */
53+ if (to_copy > 1)
54+ return res;
55+
56+ /*
57+ * If we haven't reached the end of the string, iterate through to determine
58+ * the strings total length.
59+ */
60+ while (*src++ != '\0' && ++res)
61+ ;
62+
63+ return res;
64+}
65+
66 /* XXX: If grub_memmove is too slow, we must implement grub_memcpy. */
67 static inline void *
68 grub_memcpy (void *dest, const void *src, grub_size_t n)
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45774.patch b/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
deleted file mode 100644
index 55aecc17d7..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45774.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1From 2c34af908ebf4856051ed29e46d88abd2b20387f Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Fri, 8 Mar 2024 22:47:20 +1100
4Subject: [PATCH] video/readers/jpeg: Do not permit duplicate SOF0 markers in
5 JPEG
6
7Otherwise a subsequent header could change the height and width
8allowing future OOB writes.
9
10Fixes: CVE-2024-45774
11
12Reported-by: Nils Langius <nils@langius.de>
13Signed-off-by: Daniel Axtens <dja@axtens.net>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45774
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2c34af908ebf4856051ed29e46d88abd2b20387f]
18Signed-off-by: Peter Marko <peter.marko@siemens.com>
19---
20 grub-core/video/readers/jpeg.c | 4 ++++
21 1 file changed, 4 insertions(+)
22
23diff --git a/grub-core/video/readers/jpeg.c b/grub-core/video/readers/jpeg.c
24index ae634fd41..631a89356 100644
25--- a/grub-core/video/readers/jpeg.c
26+++ b/grub-core/video/readers/jpeg.c
27@@ -339,6 +339,10 @@ grub_jpeg_decode_sof (struct grub_jpeg_data *data)
28 if (grub_errno != GRUB_ERR_NONE)
29 return grub_errno;
30
31+ if (data->image_height != 0 || data->image_width != 0)
32+ return grub_error (GRUB_ERR_BAD_FILE_TYPE,
33+ "jpeg: cannot have duplicate SOF0 markers");
34+
35 if (grub_jpeg_get_byte (data) != 8)
36 return grub_error (GRUB_ERR_BAD_FILE_TYPE,
37 "jpeg: only 8-bit precision is supported");
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45775.patch b/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
deleted file mode 100644
index 70492b8c2e..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45775.patch
+++ /dev/null
@@ -1,38 +0,0 @@
1From 05be856a8c3aae41f5df90cab7796ab7ee34b872 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:55 +0000
4Subject: [PATCH] commands/extcmd: Missing check for failed allocation
5
6The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate
7a grub_arg_list struct but it does not verify the allocation was successful.
8In case of failed allocation the NULL state pointer can be accessed in
9parse_option() through grub_arg_parse() which may lead to a security issue.
10
11Fixes: CVE-2024-45775
12
13Reported-by: Nils Langius <nils@langius.de>
14Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
16Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
17
18CVE: CVE-2024-45775
19Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872]
20Signed-off-by: Peter Marko <peter.marko@siemens.com>
21---
22 grub-core/commands/extcmd.c | 3 +++
23 1 file changed, 3 insertions(+)
24
25diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c
26index 90a5ca24a..c236be13a 100644
27--- a/grub-core/commands/extcmd.c
28+++ b/grub-core/commands/extcmd.c
29@@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args,
30 }
31
32 state = grub_arg_list_alloc (ext, argc, args);
33+ if (state == NULL)
34+ return grub_errno;
35+
36 if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc))
37 {
38 context.state = state;
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45776.patch b/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
deleted file mode 100644
index 8deea958b8..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45776.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1From 09bd6eb58b0f71ec273916070fa1e2de16897a91 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:56 +0000
4Subject: [PATCH] gettext: Integer overflow leads to heap OOB write or read
5
6Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may
7overflow leading to subsequent OOB write or read. This patch fixes the
8issue by replacing grub_zalloc() and explicit multiplication with
9grub_calloc() which does the same thing in safe manner.
10
11Fixes: CVE-2024-45776
12
13Reported-by: Nils Langius <nils@langius.de>
14Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
16Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
17
18CVE: CVE-2024-45776
19Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=09bd6eb58b0f71ec273916070fa1e2de16897a91]
20Signed-off-by: Peter Marko <peter.marko@siemens.com>
21---
22 grub-core/gettext/gettext.c | 4 ++--
23 1 file changed, 2 insertions(+), 2 deletions(-)
24
25diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
26index e4f4f8ee6..63bb1ab73 100644
27--- a/grub-core/gettext/gettext.c
28+++ b/grub-core/gettext/gettext.c
29@@ -323,8 +323,8 @@ grub_mofile_open (struct grub_gettext_context *ctx,
30 for (ctx->grub_gettext_max_log = 0; ctx->grub_gettext_max >> ctx->grub_gettext_max_log;
31 ctx->grub_gettext_max_log++);
32
33- ctx->grub_gettext_msg_list = grub_zalloc (ctx->grub_gettext_max
34- * sizeof (ctx->grub_gettext_msg_list[0]));
35+ ctx->grub_gettext_msg_list = grub_calloc (ctx->grub_gettext_max,
36+ sizeof (ctx->grub_gettext_msg_list[0]));
37 if (!ctx->grub_gettext_msg_list)
38 {
39 grub_file_close (fd);
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45777.patch b/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
deleted file mode 100644
index 0305a95fd5..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45777.patch
+++ /dev/null
@@ -1,57 +0,0 @@
1From b970a5ed967816bbca8225994cd0ee2557bad515 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:57 +0000
4Subject: [PATCH] gettext: Integer overflow leads to heap OOB write
5
6The size calculation of the translation buffer in
7grub_gettext_getstr_from_position() may overflow
8to 0 leading to heap OOB write. This patch fixes
9the issue by using grub_add() and checking for
10an overflow.
11
12Fixes: CVE-2024-45777
13
14Reported-by: Nils Langius <nils@langius.de>
15Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
18
19CVE: CVE-2024-45777
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b970a5ed967816bbca8225994cd0ee2557bad515]
21Signed-off-by: Peter Marko <peter.marko@siemens.com>
22---
23 grub-core/gettext/gettext.c | 7 ++++++-
24 1 file changed, 6 insertions(+), 1 deletion(-)
25
26diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
27index 63bb1ab73..9ffc73428 100644
28--- a/grub-core/gettext/gettext.c
29+++ b/grub-core/gettext/gettext.c
30@@ -26,6 +26,7 @@
31 #include <grub/file.h>
32 #include <grub/kernel.h>
33 #include <grub/i18n.h>
34+#include <grub/safemath.h>
35
36 GRUB_MOD_LICENSE ("GPLv3+");
37
38@@ -99,6 +100,7 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
39 char *translation;
40 struct string_descriptor desc;
41 grub_err_t err;
42+ grub_size_t alloc_sz;
43
44 internal_position = (off + position * sizeof (desc));
45
46@@ -109,7 +111,10 @@ grub_gettext_getstr_from_position (struct grub_gettext_context *ctx,
47 length = grub_cpu_to_le32 (desc.length);
48 offset = grub_cpu_to_le32 (desc.offset);
49
50- translation = grub_malloc (length + 1);
51+ if (grub_add (length, 1, &alloc_sz))
52+ return NULL;
53+
54+ translation = grub_malloc (alloc_sz);
55 if (!translation)
56 return NULL;
57
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch b/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
deleted file mode 100644
index eba013897f..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45778_CVE-2024-45779.patch
+++ /dev/null
@@ -1,55 +0,0 @@
1From 26db6605036bd9e5b16d9068a8cc75be63b8b630 Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Sat, 23 Mar 2024 15:59:43 +1100
4Subject: [PATCH] fs/bfs: Disable under lockdown
5
6The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown.
7This will also disable the AFS.
8
9Fixes: CVE-2024-45778
10Fixes: CVE-2024-45779
11
12Reported-by: Nils Langius <nils@langius.de>
13Signed-off-by: Daniel Axtens <dja@axtens.net>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45778
17CVE: CVE-2024-45779
18Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=]
19Signed-off-by: Peter Marko <peter.marko@siemens.com>
20---
21 grub-core/fs/bfs.c | 9 +++++++--
22 1 file changed, 7 insertions(+), 2 deletions(-)
23
24diff --git a/grub-core/fs/bfs.c b/grub-core/fs/bfs.c
25index 022f69fe2..78aeb051f 100644
26--- a/grub-core/fs/bfs.c
27+++ b/grub-core/fs/bfs.c
28@@ -30,6 +30,7 @@
29 #include <grub/types.h>
30 #include <grub/i18n.h>
31 #include <grub/fshelp.h>
32+#include <grub/lockdown.h>
33
34 GRUB_MOD_LICENSE ("GPLv3+");
35
36@@ -1106,7 +1107,10 @@ GRUB_MOD_INIT (bfs)
37 {
38 COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE ==
39 sizeof (struct grub_bfs_extent));
40- grub_fs_register (&grub_bfs_fs);
41+ if (!grub_is_lockdown ())
42+ {
43+ grub_fs_register (&grub_bfs_fs);
44+ }
45 }
46
47 #ifdef MODE_AFS
48@@ -1115,5 +1119,6 @@ GRUB_MOD_FINI (afs)
49 GRUB_MOD_FINI (bfs)
50 #endif
51 {
52- grub_fs_unregister (&grub_bfs_fs);
53+ if (!grub_is_lockdown ())
54+ grub_fs_unregister (&grub_bfs_fs);
55 }
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45780.patch b/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
deleted file mode 100644
index 1de0099f94..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45780.patch
+++ /dev/null
@@ -1,93 +0,0 @@
1From 0087bc6902182fe5cedce2d034c75a79cf6dd4f3 Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Fri, 22 Nov 2024 06:27:58 +0000
4Subject: [PATCH] fs/tar: Integer overflow leads to heap OOB write
5
6Both namesize and linksize are derived from hd.size, a 12-digit octal
7number parsed by read_number(). Later direct arithmetic calculation like
8"namesize + 1" and "linksize + 1" may exceed the maximum value of
9grub_size_t leading to heap OOB write. This patch fixes the issue by
10using grub_add() and checking for an overflow.
11
12Fixes: CVE-2024-45780
13
14Reported-by: Nils Langius <nils@langius.de>
15Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
18
19CVE: CVE-2024-45780
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=0087bc6902182fe5cedce2d034c75a79cf6dd4f3]
21Signed-off-by: Peter Marko <peter.marko@siemens.com>
22---
23 grub-core/fs/tar.c | 23 ++++++++++++++++++-----
24 1 file changed, 18 insertions(+), 5 deletions(-)
25
26diff --git a/grub-core/fs/tar.c b/grub-core/fs/tar.c
27index 646bce5eb..386c09022 100644
28--- a/grub-core/fs/tar.c
29+++ b/grub-core/fs/tar.c
30@@ -25,6 +25,7 @@
31 #include <grub/mm.h>
32 #include <grub/dl.h>
33 #include <grub/i18n.h>
34+#include <grub/safemath.h>
35
36 GRUB_MOD_LICENSE ("GPLv3+");
37
38@@ -76,6 +77,7 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
39 {
40 struct head hd;
41 int reread = 0, have_longname = 0, have_longlink = 0;
42+ grub_size_t sz;
43
44 data->hofs = data->next_hofs;
45
46@@ -97,7 +99,11 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
47 {
48 grub_err_t err;
49 grub_size_t namesize = read_number (hd.size, sizeof (hd.size));
50- *name = grub_malloc (namesize + 1);
51+
52+ if (grub_add (namesize, 1, &sz))
53+ return grub_error (GRUB_ERR_BAD_FS, N_("name size overflow"));
54+
55+ *name = grub_malloc (sz);
56 if (*name == NULL)
57 return grub_errno;
58 err = grub_disk_read (data->disk, 0,
59@@ -117,15 +123,19 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
60 {
61 grub_err_t err;
62 grub_size_t linksize = read_number (hd.size, sizeof (hd.size));
63- if (data->linkname_alloc < linksize + 1)
64+
65+ if (grub_add (linksize, 1, &sz))
66+ return grub_error (GRUB_ERR_BAD_FS, N_("link size overflow"));
67+
68+ if (data->linkname_alloc < sz)
69 {
70 char *n;
71- n = grub_calloc (2, linksize + 1);
72+ n = grub_calloc (2, sz);
73 if (!n)
74 return grub_errno;
75 grub_free (data->linkname);
76 data->linkname = n;
77- data->linkname_alloc = 2 * (linksize + 1);
78+ data->linkname_alloc = 2 * (sz);
79 }
80
81 err = grub_disk_read (data->disk, 0,
82@@ -148,7 +158,10 @@ grub_cpio_find_file (struct grub_archelp_data *data, char **name,
83 while (extra_size < sizeof (hd.prefix)
84 && hd.prefix[extra_size])
85 extra_size++;
86- *name = grub_malloc (sizeof (hd.name) + extra_size + 2);
87+
88+ if (grub_add (sizeof (hd.name) + 2, extra_size, &sz))
89+ return grub_error (GRUB_ERR_BAD_FS, N_("long name size overflow"));
90+ *name = grub_malloc (sz);
91 if (*name == NULL)
92 return grub_errno;
93 if (hd.prefix[0])
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45781.patch b/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
deleted file mode 100644
index bd0b6aa04a..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45781.patch
+++ /dev/null
@@ -1,35 +0,0 @@
1From c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sun, 12 May 2024 02:03:33 +0100
4Subject: [PATCH 2/2] fs/ufs: Fix a heap OOB write
5
6grub_strcpy() was used to copy a symlink name from the filesystem
7image to a heap allocated buffer. This led to a OOB write to adjacent
8heap allocations. Fix by using grub_strlcpy().
9
10Fixes: CVE-2024-45781
11
12Reported-by: B Horn <b@horn.uk>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45781
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=c1a291b01f4f1dcd6a22b61f1c81a45a966d16ba]
18Signed-off-by: Peter Marko <peter.marko@siemens.com>
19---
20 grub-core/fs/ufs.c | 2 +-
21 1 file changed, 1 insertion(+), 1 deletion(-)
22
23diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
24index a354c92d9..01235101b 100644
25--- a/grub-core/fs/ufs.c
26+++ b/grub-core/fs/ufs.c
27@@ -463,7 +463,7 @@ grub_ufs_lookup_symlink (struct grub_ufs_data *data, int ino)
28 /* Check against zero is paylindromic, no need to swap. */
29 if (data->inode.nblocks == 0
30 && INODE_SIZE (data) <= sizeof (data->inode.symlink))
31- grub_strcpy (symlink, (char *) data->inode.symlink);
32+ grub_strlcpy (symlink, (char *) data->inode.symlink, sz);
33 else
34 {
35 if (grub_ufs_read_file (data, 0, 0, 0, sz, symlink) < 0)
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch b/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
deleted file mode 100644
index 41cc025b81..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45782_CVE-2024-56737.patch
+++ /dev/null
@@ -1,36 +0,0 @@
1From 417547c10410b714e43f08f74137c24015f8f4c3 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sun, 12 May 2024 02:48:33 +0100
4Subject: [PATCH] fs/hfs: Fix stack OOB write with grub_strcpy()
5
6Replaced with grub_strlcpy().
7
8Fixes: CVE-2024-45782
9Fixes: CVE-2024-56737
10Fixes: https://savannah.gnu.org/bugs/?66599
11
12Reported-by: B Horn <b@horn.uk>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2024-45782
17CVE: CVE-2024-56737
18Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=417547c10410b714e43f08f74137c24015f8f4c3]
19Signed-off-by: Peter Marko <peter.marko@siemens.com>
20---
21 grub-core/fs/hfs.c | 2 +-
22 1 file changed, 1 insertion(+), 1 deletion(-)
23
24diff --git a/grub-core/fs/hfs.c b/grub-core/fs/hfs.c
25index 91dc0e69c..920112b03 100644
26--- a/grub-core/fs/hfs.c
27+++ b/grub-core/fs/hfs.c
28@@ -379,7 +379,7 @@ grub_hfs_mount (grub_disk_t disk)
29 volume name. */
30 key.parent_dir = grub_cpu_to_be32_compile_time (1);
31 key.strlen = data->sblock.volname[0];
32- grub_strcpy ((char *) key.str, (char *) (data->sblock.volname + 1));
33+ grub_strlcpy ((char *) key.str, (char *) (data->sblock.volname + 1), sizeof (key.str));
34
35 if (grub_hfs_find_node (data, (char *) &key, data->cat_root,
36 0, (char *) &dir, sizeof (dir)) == 0)
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-45783.patch b/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
deleted file mode 100644
index 99c769961b..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-45783.patch
+++ /dev/null
@@ -1,39 +0,0 @@
1From f7c070a2e28dfab7137db0739fb8db1dc02d8898 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Sun, 12 May 2024 06:22:51 +0100
4Subject: [PATCH] fs/hfsplus: Set a grub_errno if mount fails
5
6It was possible for mount to fail but not set grub_errno. This led to
7a possible double decrement of the module reference count if the NULL
8page was mapped.
9
10Fixing in general as a similar bug was fixed in commit 61b13c187
11(fs/hfsplus: Set grub_errno to prevent NULL pointer access) and there
12are likely more variants around.
13
14Fixes: CVE-2024-45783
15
16Reported-by: B Horn <b@horn.uk>
17Signed-off-by: B Horn <b@horn.uk>
18Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
19
20CVE: CVE-2024-45783
21Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=f7c070a2e28dfab7137db0739fb8db1dc02d8898]
22Signed-off-by: Peter Marko <peter.marko@siemens.com>
23---
24 grub-core/fs/hfsplus.c | 2 +-
25 1 file changed, 1 insertion(+), 1 deletion(-)
26
27diff --git a/grub-core/fs/hfsplus.c b/grub-core/fs/hfsplus.c
28index 295822f69..de71fd486 100644
29--- a/grub-core/fs/hfsplus.c
30+++ b/grub-core/fs/hfsplus.c
31@@ -405,7 +405,7 @@ grub_hfsplus_mount (grub_disk_t disk)
32
33 fail:
34
35- if (grub_errno == GRUB_ERR_OUT_OF_RANGE)
36+ if (grub_errno == GRUB_ERR_OUT_OF_RANGE || grub_errno == GRUB_ERR_NONE)
37 grub_error (GRUB_ERR_BAD_FS, "not a HFS+ filesystem");
38
39 grub_free (data);
diff --git a/meta/recipes-bsp/grub/files/CVE-2024-56738.patch b/meta/recipes-bsp/grub/files/CVE-2024-56738.patch
deleted file mode 100644
index c7b64aa6ed..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2024-56738.patch
+++ /dev/null
@@ -1,75 +0,0 @@
1From 4cef2fc7308b2132317ad166939994f098b41561 Mon Sep 17 00:00:00 2001
2From: Ross Burton <ross.burton@arm.com>
3Date: Tue, 9 Sep 2025 14:23:14 +0100
4Subject: [PATCH] CVE-2024-56738
5
6Backport an algorithmic change to grub_crypto_memcmp() so that it completes in
7constant time and thus isn't susceptible to side-channel attacks.
8
9This is a partial backport of grub 0739d24cd
10("libgcrypt: Adjust import script, definitions and API users for libgcrypt 1.11")
11
12CVE: CVE-2024-56738
13Upstream-Status: Backport [0739d24cd]
14Signed-off-by: Ross Burton <ross.burton@arm.com>
15---
16 grub-core/lib/crypto.c | 23 ++++++++++++++++-------
17 include/grub/crypto.h | 2 +-
18 2 files changed, 17 insertions(+), 8 deletions(-)
19
20diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
21index 396f76410..19db7870a 100644
22--- a/grub-core/lib/crypto.c
23+++ b/grub-core/lib/crypto.c
24@@ -433,19 +433,28 @@ grub_crypto_gcry_error (gcry_err_code_t in)
25 return GRUB_ACCESS_DENIED;
26 }
27
28+/*
29+ * Compare byte arrays of length LEN, return 1 if it's not same,
30+ * 0, otherwise.
31+ */
32 int
33-grub_crypto_memcmp (const void *a, const void *b, grub_size_t n)
34+grub_crypto_memcmp (const void *b1, const void *b2, grub_size_t len)
35 {
36- register grub_size_t counter = 0;
37- const grub_uint8_t *pa, *pb;
38+ const grub_uint8_t *a = b1;
39+ const grub_uint8_t *b = b2;
40+ int ab, ba;
41+ grub_size_t i;
42
43- for (pa = a, pb = b; n; pa++, pb++, n--)
44+ /* Constant-time compare. */
45+ for (i = 0, ab = 0, ba = 0; i < len; i++)
46 {
47- if (*pa != *pb)
48- counter++;
49+ /* If a[i] != b[i], either ab or ba will be negative. */
50+ ab |= a[i] - b[i];
51+ ba |= b[i] - a[i];
52 }
53
54- return !!counter;
55+ /* 'ab | ba' is negative when buffers are not equal, extract sign bit. */
56+ return ((unsigned int)(ab | ba) >> (sizeof(unsigned int) * 8 - 1)) & 1;
57 }
58
59 #ifndef GRUB_UTIL
60diff --git a/include/grub/crypto.h b/include/grub/crypto.h
61index 31c87c302..20ad4c5f7 100644
62--- a/include/grub/crypto.h
63+++ b/include/grub/crypto.h
64@@ -393,7 +393,7 @@ grub_crypto_pbkdf2 (const struct gcry_md_spec *md,
65 grub_uint8_t *DK, grub_size_t dkLen);
66
67 int
68-grub_crypto_memcmp (const void *a, const void *b, grub_size_t n);
69+grub_crypto_memcmp (const void *b1, const void *b2, grub_size_t len);
70
71 int
72 grub_password_get (char buf[], unsigned buf_size);
73--
742.43.0
75
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
deleted file mode 100644
index 09dbfce5f8..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-0622-01.patch
+++ /dev/null
@@ -1,35 +0,0 @@
1From 2123c5bca7e21fbeb0263df4597ddd7054700726 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 1 Nov 2024 19:24:29 +0000
4Subject: [PATCH 1/3] commands/pgp: Unregister the "check_signatures" hooks on
5 module unload
6
7If the hooks are not removed they can be called after the module has
8been unloaded leading to an use-after-free.
9
10Fixes: CVE-2025-0622
11
12Reported-by: B Horn <b@horn.uk>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2025-0622
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=2123c5bca7e21fbeb0263df4597ddd7054700726]
18Signed-off-by: Peter Marko <peter.marko@siemens.com>
19---
20 grub-core/commands/pgp.c | 2 ++
21 1 file changed, 2 insertions(+)
22
23diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
24index c6766f044..5fadc33c4 100644
25--- a/grub-core/commands/pgp.c
26+++ b/grub-core/commands/pgp.c
27@@ -1010,6 +1010,8 @@ GRUB_MOD_INIT(pgp)
28
29 GRUB_MOD_FINI(pgp)
30 {
31+ grub_register_variable_hook ("check_signatures", NULL, NULL);
32+ grub_env_unset ("check_signatures");
33 grub_verifier_unregister (&grub_pubkey_verifier);
34 grub_unregister_extcmd (cmd);
35 grub_unregister_extcmd (cmd_trust);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
deleted file mode 100644
index be01da3355..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-0622-02.patch
+++ /dev/null
@@ -1,41 +0,0 @@
1From 9c16197734ada8d0838407eebe081117799bfe67 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 1 Nov 2024 23:46:55 +0000
4Subject: [PATCH 2/3] normal: Remove variables hooks on module unload
5
6The normal module does not entirely cleanup after itself in
7its GRUB_MOD_FINI() leaving a few variables hooks in place.
8It is not possible to unload normal module now but fix the
9issues for completeness.
10
11On the occasion replace 0s with NULLs for "pager" variable
12hooks unregister.
13
14Fixes: CVE-2025-0622
15
16Reported-by: B Horn <b@horn.uk>
17Signed-off-by: B Horn <b@horn.uk>
18Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
19
20CVE: CVE-2025-0622
21Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=9c16197734ada8d0838407eebe081117799bfe67]
22Signed-off-by: Peter Marko <peter.marko@siemens.com>
23---
24 grub-core/normal/main.c | 4 +++-
25 1 file changed, 3 insertions(+), 1 deletion(-)
26
27diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
28index 838f57fa5..04d058f55 100644
29--- a/grub-core/normal/main.c
30+++ b/grub-core/normal/main.c
31@@ -582,7 +582,9 @@ GRUB_MOD_FINI(normal)
32 grub_xputs = grub_xputs_saved;
33
34 grub_set_history (0);
35- grub_register_variable_hook ("pager", 0, 0);
36+ grub_register_variable_hook ("pager", NULL, NULL);
37+ grub_register_variable_hook ("color_normal", NULL, NULL);
38+ grub_register_variable_hook ("color_highlight", NULL, NULL);
39 grub_fs_autoload_hook = 0;
40 grub_unregister_command (cmd_clear);
41 }
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch b/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
deleted file mode 100644
index 79078a4350..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-0622-03.patch
+++ /dev/null
@@ -1,38 +0,0 @@
1From 7580addfc8c94cedb0cdfd7a1fd65b539215e637 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 1 Nov 2024 23:52:06 +0000
4Subject: [PATCH 3/3] gettext: Remove variables hooks on module unload
5
6The gettext module does not entirely cleanup after itself in
7its GRUB_MOD_FINI() leaving a few variables hooks in place.
8It is not possible to unload gettext module because normal
9module depends on it. Though fix the issues for completeness.
10
11Fixes: CVE-2025-0622
12
13Reported-by: B Horn <b@horn.uk>
14Signed-off-by: B Horn <b@horn.uk>
15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
16
17CVE: CVE-2025-0622
18Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637]
19Signed-off-by: Peter Marko <peter.marko@siemens.com>
20---
21 grub-core/gettext/gettext.c | 4 ++++
22 1 file changed, 4 insertions(+)
23
24diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c
25index 7a1c14e4f..e4f4f8ee6 100644
26--- a/grub-core/gettext/gettext.c
27+++ b/grub-core/gettext/gettext.c
28@@ -535,6 +535,10 @@ GRUB_MOD_INIT (gettext)
29
30 GRUB_MOD_FINI (gettext)
31 {
32+ grub_register_variable_hook ("locale_dir", NULL, NULL);
33+ grub_register_variable_hook ("secondary_locale_dir", NULL, NULL);
34+ grub_register_variable_hook ("lang", NULL, NULL);
35+
36 grub_gettext_delete_list (&main_context);
37 grub_gettext_delete_list (&secondary_context);
38
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0624.patch b/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
deleted file mode 100644
index 229fe6399e..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-0624.patch
+++ /dev/null
@@ -1,84 +0,0 @@
1From 5eef88152833062a3f7e017535372d64ac8ef7e1 Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Fri, 15 Nov 2024 13:12:09 +0000
4Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file()
5
6The function included a call to grub_strcpy() which copied data from an
7environment variable to a buffer allocated in grub_cmd_normal(). The
8grub_cmd_normal() didn't consider the length of the environment variable.
9So, the copy operation could exceed the allocation and lead to an OOB
10write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and
11pass the underlying buffers size to the grub_net_search_config_file().
12
13Fixes: CVE-2025-0624
14
15Reported-by: B Horn <b@horn.uk>
16Signed-off-by: B Horn <b@horn.uk>
17Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
18
19CVE: CVE-2025-0624
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=5eef88152833062a3f7e017535372d64ac8ef7e1]
21Signed-off-by: Peter Marko <peter.marko@siemens.com>
22---
23 grub-core/net/net.c | 7 ++++---
24 grub-core/normal/main.c | 2 +-
25 include/grub/net.h | 2 +-
26 3 files changed, 6 insertions(+), 5 deletions(-)
27
28diff --git a/grub-core/net/net.c b/grub-core/net/net.c
29index 0e41e21a5..9939ff601 100644
30--- a/grub-core/net/net.c
31+++ b/grub-core/net/net.c
32@@ -1909,14 +1909,15 @@ grub_config_search_through (char *config, char *suffix,
33 }
34
35 grub_err_t
36-grub_net_search_config_file (char *config)
37+grub_net_search_config_file (char *config, grub_size_t config_buf_len)
38 {
39- grub_size_t config_len;
40+ grub_size_t config_len, suffix_len;
41 char *suffix;
42
43 config_len = grub_strlen (config);
44 config[config_len] = '-';
45 suffix = config + config_len + 1;
46+ suffix_len = config_buf_len - (config_len + 1);
47
48 struct grub_net_network_level_interface *inf;
49 FOR_NET_NETWORK_LEVEL_INTERFACES (inf)
50@@ -1942,7 +1943,7 @@ grub_net_search_config_file (char *config)
51
52 if (client_uuid)
53 {
54- grub_strcpy (suffix, client_uuid);
55+ grub_strlcpy (suffix, client_uuid, suffix_len);
56 if (grub_config_search_through (config, suffix, 1, 0) == 0)
57 return GRUB_ERR_NONE;
58 }
59diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
60index 90879dc21..838f57fa5 100644
61--- a/grub-core/normal/main.c
62+++ b/grub-core/normal/main.c
63@@ -344,7 +344,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)),
64
65 if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 &&
66 !disable_net_search)
67- grub_net_search_config_file (config);
68+ grub_net_search_config_file (config, config_len);
69
70 grub_enter_normal_mode (config);
71 grub_free (config);
72diff --git a/include/grub/net.h b/include/grub/net.h
73index 228d04963..58a4f83fc 100644
74--- a/include/grub/net.h
75+++ b/include/grub/net.h
76@@ -579,7 +579,7 @@ void
77 grub_net_remove_dns_server (const struct grub_net_network_level_address *s);
78
79 grub_err_t
80-grub_net_search_config_file (char *config);
81+grub_net_search_config_file (char *config, grub_size_t config_buf_len);
82
83 extern char *grub_net_default_server;
84
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch b/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
deleted file mode 100644
index d5563cecc4..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch
+++ /dev/null
@@ -1,377 +0,0 @@
1From 47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10 Mon Sep 17 00:00:00 2001
2From: Daniel Axtens <dja@axtens.net>
3Date: Sat, 23 Mar 2024 16:20:45 +1100
4Subject: [PATCH] fs: Disable many filesystems under lockdown
5
6The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat,
7hfsplus, iso9660, squash4, tar, xfs and zfs.
8
9The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were
10reported by Jonathan Bar Or <jonathanbaror@gmail.com>.
11
12Fixes: CVE-2025-0677
13Fixes: CVE-2025-0684
14Fixes: CVE-2025-0685
15Fixes: CVE-2025-0686
16Fixes: CVE-2025-0689
17
18Suggested-by: Daniel Axtens <dja@axtens.net>
19Signed-off-by: Daniel Axtens <dja@axtens.net>
20Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
21
22CVE: CVE-2025-0677
23CVE: CVE-2025-0684
24CVE: CVE-2025-0685
25CVE: CVE-2025-0686
26CVE: CVE-2025-0689
27Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=47b2dfc7953f70f98ddf35dfdd6e7f4f20283b10]
28Signed-off-by: Peter Marko <peter.marko@siemens.com>
29---
30 grub-core/fs/affs.c | 9 +++++++--
31 grub-core/fs/cbfs.c | 9 +++++++--
32 grub-core/fs/jfs.c | 9 +++++++--
33 grub-core/fs/minix.c | 9 +++++++--
34 grub-core/fs/nilfs2.c | 9 +++++++--
35 grub-core/fs/ntfs.c | 9 +++++++--
36 grub-core/fs/reiserfs.c | 9 +++++++--
37 grub-core/fs/romfs.c | 9 +++++++--
38 grub-core/fs/sfs.c | 9 +++++++--
39 grub-core/fs/udf.c | 9 +++++++--
40 grub-core/fs/ufs.c | 9 +++++++--
41 11 files changed, 77 insertions(+), 22 deletions(-)
42
43diff --git a/grub-core/fs/affs.c b/grub-core/fs/affs.c
44index ed606b3f1..352f5d232 100644
45--- a/grub-core/fs/affs.c
46+++ b/grub-core/fs/affs.c
47@@ -26,6 +26,7 @@
48 #include <grub/types.h>
49 #include <grub/fshelp.h>
50 #include <grub/charset.h>
51+#include <grub/lockdown.h>
52
53 GRUB_MOD_LICENSE ("GPLv3+");
54
55@@ -703,11 +704,15 @@ static struct grub_fs grub_affs_fs =
56
57 GRUB_MOD_INIT(affs)
58 {
59- grub_fs_register (&grub_affs_fs);
60+ if (!grub_is_lockdown ())
61+ {
62+ grub_fs_register (&grub_affs_fs);
63+ }
64 my_mod = mod;
65 }
66
67 GRUB_MOD_FINI(affs)
68 {
69- grub_fs_unregister (&grub_affs_fs);
70+ if (!grub_is_lockdown ())
71+ grub_fs_unregister (&grub_affs_fs);
72 }
73diff --git a/grub-core/fs/cbfs.c b/grub-core/fs/cbfs.c
74index 8ab7106af..f6349df34 100644
75--- a/grub-core/fs/cbfs.c
76+++ b/grub-core/fs/cbfs.c
77@@ -26,6 +26,7 @@
78 #include <grub/dl.h>
79 #include <grub/i18n.h>
80 #include <grub/cbfs_core.h>
81+#include <grub/lockdown.h>
82
83 GRUB_MOD_LICENSE ("GPLv3+");
84
85@@ -390,12 +391,16 @@ GRUB_MOD_INIT (cbfs)
86 #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
87 init_cbfsdisk ();
88 #endif
89- grub_fs_register (&grub_cbfs_fs);
90+ if (!grub_is_lockdown ())
91+ {
92+ grub_fs_register (&grub_cbfs_fs);
93+ }
94 }
95
96 GRUB_MOD_FINI (cbfs)
97 {
98- grub_fs_unregister (&grub_cbfs_fs);
99+ if (!grub_is_lockdown ())
100+ grub_fs_unregister (&grub_cbfs_fs);
101 #if (defined (__i386__) || defined (__x86_64__)) && !defined (GRUB_UTIL) && !defined (GRUB_MACHINE_EMU) && !defined (GRUB_MACHINE_XEN)
102 fini_cbfsdisk ();
103 #endif
104diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
105index 6f7c43904..c0bbab8a9 100644
106--- a/grub-core/fs/jfs.c
107+++ b/grub-core/fs/jfs.c
108@@ -26,6 +26,7 @@
109 #include <grub/types.h>
110 #include <grub/charset.h>
111 #include <grub/i18n.h>
112+#include <grub/lockdown.h>
113
114 GRUB_MOD_LICENSE ("GPLv3+");
115
116@@ -963,11 +964,15 @@ static struct grub_fs grub_jfs_fs =
117
118 GRUB_MOD_INIT(jfs)
119 {
120- grub_fs_register (&grub_jfs_fs);
121+ if (!grub_is_lockdown ())
122+ {
123+ grub_fs_register (&grub_jfs_fs);
124+ }
125 my_mod = mod;
126 }
127
128 GRUB_MOD_FINI(jfs)
129 {
130- grub_fs_unregister (&grub_jfs_fs);
131+ if (!grub_is_lockdown ())
132+ grub_fs_unregister (&grub_jfs_fs);
133 }
134diff --git a/grub-core/fs/minix.c b/grub-core/fs/minix.c
135index 5354951d1..c267298b5 100644
136--- a/grub-core/fs/minix.c
137+++ b/grub-core/fs/minix.c
138@@ -25,6 +25,7 @@
139 #include <grub/dl.h>
140 #include <grub/types.h>
141 #include <grub/i18n.h>
142+#include <grub/lockdown.h>
143
144 GRUB_MOD_LICENSE ("GPLv3+");
145
146@@ -734,7 +735,10 @@ GRUB_MOD_INIT(minix)
147 #endif
148 #endif
149 {
150- grub_fs_register (&grub_minix_fs);
151+ if (!grub_is_lockdown ())
152+ {
153+ grub_fs_register (&grub_minix_fs);
154+ }
155 my_mod = mod;
156 }
157
158@@ -756,5 +760,6 @@ GRUB_MOD_FINI(minix)
159 #endif
160 #endif
161 {
162- grub_fs_unregister (&grub_minix_fs);
163+ if (!grub_is_lockdown ())
164+ grub_fs_unregister (&grub_minix_fs);
165 }
166diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
167index fc7374ead..08abf173f 100644
168--- a/grub-core/fs/nilfs2.c
169+++ b/grub-core/fs/nilfs2.c
170@@ -34,6 +34,7 @@
171 #include <grub/dl.h>
172 #include <grub/types.h>
173 #include <grub/fshelp.h>
174+#include <grub/lockdown.h>
175
176 GRUB_MOD_LICENSE ("GPLv3+");
177
178@@ -1231,11 +1232,15 @@ GRUB_MOD_INIT (nilfs2)
179 grub_nilfs2_dat_entry));
180 COMPILE_TIME_ASSERT (1 << LOG_INODE_SIZE
181 == sizeof (struct grub_nilfs2_inode));
182- grub_fs_register (&grub_nilfs2_fs);
183+ if (!grub_is_lockdown ())
184+ {
185+ grub_fs_register (&grub_nilfs2_fs);
186+ }
187 my_mod = mod;
188 }
189
190 GRUB_MOD_FINI (nilfs2)
191 {
192- grub_fs_unregister (&grub_nilfs2_fs);
193+ if (!grub_is_lockdown ())
194+ grub_fs_unregister (&grub_nilfs2_fs);
195 }
196diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c
197index de435aa14..8cc2ba3d5 100644
198--- a/grub-core/fs/ntfs.c
199+++ b/grub-core/fs/ntfs.c
200@@ -27,6 +27,7 @@
201 #include <grub/fshelp.h>
202 #include <grub/ntfs.h>
203 #include <grub/charset.h>
204+#include <grub/lockdown.h>
205
206 GRUB_MOD_LICENSE ("GPLv3+");
207
208@@ -1320,11 +1321,15 @@ static struct grub_fs grub_ntfs_fs =
209
210 GRUB_MOD_INIT (ntfs)
211 {
212- grub_fs_register (&grub_ntfs_fs);
213+ if (!grub_is_lockdown ())
214+ {
215+ grub_fs_register (&grub_ntfs_fs);
216+ }
217 my_mod = mod;
218 }
219
220 GRUB_MOD_FINI (ntfs)
221 {
222- grub_fs_unregister (&grub_ntfs_fs);
223+ if (!grub_is_lockdown ())
224+ grub_fs_unregister (&grub_ntfs_fs);
225 }
226diff --git a/grub-core/fs/reiserfs.c b/grub-core/fs/reiserfs.c
227index 36b26ac98..cdef2eba0 100644
228--- a/grub-core/fs/reiserfs.c
229+++ b/grub-core/fs/reiserfs.c
230@@ -39,6 +39,7 @@
231 #include <grub/types.h>
232 #include <grub/fshelp.h>
233 #include <grub/i18n.h>
234+#include <grub/lockdown.h>
235
236 GRUB_MOD_LICENSE ("GPLv3+");
237
238@@ -1417,11 +1418,15 @@ static struct grub_fs grub_reiserfs_fs =
239
240 GRUB_MOD_INIT(reiserfs)
241 {
242- grub_fs_register (&grub_reiserfs_fs);
243+ if (!grub_is_lockdown ())
244+ {
245+ grub_fs_register (&grub_reiserfs_fs);
246+ }
247 my_mod = mod;
248 }
249
250 GRUB_MOD_FINI(reiserfs)
251 {
252- grub_fs_unregister (&grub_reiserfs_fs);
253+ if (!grub_is_lockdown ())
254+ grub_fs_unregister (&grub_reiserfs_fs);
255 }
256diff --git a/grub-core/fs/romfs.c b/grub-core/fs/romfs.c
257index 1f7dcfca1..acf8dd21e 100644
258--- a/grub-core/fs/romfs.c
259+++ b/grub-core/fs/romfs.c
260@@ -23,6 +23,7 @@
261 #include <grub/disk.h>
262 #include <grub/fs.h>
263 #include <grub/fshelp.h>
264+#include <grub/lockdown.h>
265
266 GRUB_MOD_LICENSE ("GPLv3+");
267
268@@ -475,10 +476,14 @@ static struct grub_fs grub_romfs_fs =
269
270 GRUB_MOD_INIT(romfs)
271 {
272- grub_fs_register (&grub_romfs_fs);
273+ if (!grub_is_lockdown ())
274+ {
275+ grub_fs_register (&grub_romfs_fs);
276+ }
277 }
278
279 GRUB_MOD_FINI(romfs)
280 {
281- grub_fs_unregister (&grub_romfs_fs);
282+ if (!grub_is_lockdown ())
283+ grub_fs_unregister (&grub_romfs_fs);
284 }
285diff --git a/grub-core/fs/sfs.c b/grub-core/fs/sfs.c
286index 983e88008..f64bdd2df 100644
287--- a/grub-core/fs/sfs.c
288+++ b/grub-core/fs/sfs.c
289@@ -26,6 +26,7 @@
290 #include <grub/types.h>
291 #include <grub/fshelp.h>
292 #include <grub/charset.h>
293+#include <grub/lockdown.h>
294 #include <grub/safemath.h>
295
296 GRUB_MOD_LICENSE ("GPLv3+");
297@@ -779,11 +780,15 @@ static struct grub_fs grub_sfs_fs =
298
299 GRUB_MOD_INIT(sfs)
300 {
301- grub_fs_register (&grub_sfs_fs);
302+ if (!grub_is_lockdown ())
303+ {
304+ grub_fs_register (&grub_sfs_fs);
305+ }
306 my_mod = mod;
307 }
308
309 GRUB_MOD_FINI(sfs)
310 {
311- grub_fs_unregister (&grub_sfs_fs);
312+ if (!grub_is_lockdown ())
313+ grub_fs_unregister (&grub_sfs_fs);
314 }
315diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
316index b836e6107..a60643be1 100644
317--- a/grub-core/fs/udf.c
318+++ b/grub-core/fs/udf.c
319@@ -27,6 +27,7 @@
320 #include <grub/fshelp.h>
321 #include <grub/charset.h>
322 #include <grub/datetime.h>
323+#include <grub/lockdown.h>
324 #include <grub/udf.h>
325 #include <grub/safemath.h>
326
327@@ -1455,11 +1456,15 @@ static struct grub_fs grub_udf_fs = {
328
329 GRUB_MOD_INIT (udf)
330 {
331- grub_fs_register (&grub_udf_fs);
332+ if (!grub_is_lockdown ())
333+ {
334+ grub_fs_register (&grub_udf_fs);
335+ }
336 my_mod = mod;
337 }
338
339 GRUB_MOD_FINI (udf)
340 {
341- grub_fs_unregister (&grub_udf_fs);
342+ if (!grub_is_lockdown ())
343+ grub_fs_unregister (&grub_udf_fs);
344 }
345diff --git a/grub-core/fs/ufs.c b/grub-core/fs/ufs.c
346index 01235101b..6b496e7b8 100644
347--- a/grub-core/fs/ufs.c
348+++ b/grub-core/fs/ufs.c
349@@ -25,6 +25,7 @@
350 #include <grub/dl.h>
351 #include <grub/types.h>
352 #include <grub/i18n.h>
353+#include <grub/lockdown.h>
354
355 GRUB_MOD_LICENSE ("GPLv3+");
356
357@@ -899,7 +900,10 @@ GRUB_MOD_INIT(ufs1)
358 #endif
359 #endif
360 {
361- grub_fs_register (&grub_ufs_fs);
362+ if (!grub_is_lockdown ())
363+ {
364+ grub_fs_register (&grub_ufs_fs);
365+ }
366 my_mod = mod;
367 }
368
369@@ -913,6 +917,7 @@ GRUB_MOD_FINI(ufs1)
370 #endif
371 #endif
372 {
373- grub_fs_unregister (&grub_ufs_fs);
374+ if (!grub_is_lockdown ())
375+ grub_fs_unregister (&grub_ufs_fs);
376 }
377
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch b/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
deleted file mode 100644
index 14e67cf35b..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-0678_CVE-2025-1125.patch
+++ /dev/null
@@ -1,87 +0,0 @@
1From 84bc0a9a68835952ae69165c11709811dae7634e Mon Sep 17 00:00:00 2001
2From: Lidong Chen <lidong.chen@oracle.com>
3Date: Tue, 21 Jan 2025 19:02:37 +0000
4Subject: [PATCH] fs: Prevent overflows when allocating memory for arrays
5
6Use grub_calloc() when allocating memory for arrays to ensure proper
7overflow checks are in place.
8
9The HFS+ and squash4 security vulnerabilities were reported by
10Jonathan Bar Or <jonathanbaror@gmail.com>.
11
12Fixes: CVE-2025-0678
13Fixes: CVE-2025-1125
14
15Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17
18CVE: CVE-2025-0678
19CVE: CVE-2025-1125
20Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=84bc0a9a68835952ae69165c11709811dae7634e]
21Signed-off-by: Peter Marko <peter.marko@siemens.com>
22---
23 grub-core/fs/btrfs.c | 4 ++--
24 grub-core/fs/hfspluscomp.c | 9 +++++++--
25 grub-core/fs/squash4.c | 8 ++++----
26 3 files changed, 13 insertions(+), 8 deletions(-)
27
28diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
29index 0625b1166..9c1e925c9 100644
30--- a/grub-core/fs/btrfs.c
31+++ b/grub-core/fs/btrfs.c
32@@ -1276,8 +1276,8 @@ grub_btrfs_mount (grub_device_t dev)
33 }
34
35 data->n_devices_allocated = 16;
36- data->devices_attached = grub_malloc (sizeof (data->devices_attached[0])
37- * data->n_devices_allocated);
38+ data->devices_attached = grub_calloc (data->n_devices_allocated,
39+ sizeof (data->devices_attached[0]));
40 if (!data->devices_attached)
41 {
42 grub_free (data);
43diff --git a/grub-core/fs/hfspluscomp.c b/grub-core/fs/hfspluscomp.c
44index 48ae438d8..a80954ee6 100644
45--- a/grub-core/fs/hfspluscomp.c
46+++ b/grub-core/fs/hfspluscomp.c
47@@ -244,14 +244,19 @@ hfsplus_open_compressed_real (struct grub_hfsplus_file *node)
48 return 0;
49 }
50 node->compress_index_size = grub_le_to_cpu32 (index_size);
51- node->compress_index = grub_malloc (node->compress_index_size
52- * sizeof (node->compress_index[0]));
53+ node->compress_index = grub_calloc (node->compress_index_size,
54+ sizeof (node->compress_index[0]));
55 if (!node->compress_index)
56 {
57 node->compressed = 0;
58 grub_free (attr_node);
59 return grub_errno;
60 }
61+
62+ /*
63+ * The node->compress_index_size * sizeof (node->compress_index[0]) is safe here
64+ * due to relevant checks done in grub_calloc() above.
65+ */
66 if (grub_hfsplus_read_file (node, 0, 0,
67 0x104 + sizeof (index_size),
68 node->compress_index_size
69diff --git a/grub-core/fs/squash4.c b/grub-core/fs/squash4.c
70index f91ff3bfa..cf2bca822 100644
71--- a/grub-core/fs/squash4.c
72+++ b/grub-core/fs/squash4.c
73@@ -816,10 +816,10 @@ direct_read (struct grub_squash_data *data,
74 break;
75 }
76 total_blocks = ((total_size + data->blksz - 1) >> data->log2_blksz);
77- ino->block_sizes = grub_malloc (total_blocks
78- * sizeof (ino->block_sizes[0]));
79- ino->cumulated_block_sizes = grub_malloc (total_blocks
80- * sizeof (ino->cumulated_block_sizes[0]));
81+ ino->block_sizes = grub_calloc (total_blocks,
82+ sizeof (ino->block_sizes[0]));
83+ ino->cumulated_block_sizes = grub_calloc (total_blocks,
84+ sizeof (ino->cumulated_block_sizes[0]));
85 if (!ino->block_sizes || !ino->cumulated_block_sizes)
86 {
87 grub_free (ino->block_sizes);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-0690.patch b/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
deleted file mode 100644
index be585c96ad..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-0690.patch
+++ /dev/null
@@ -1,73 +0,0 @@
1From dad8f502974ed9ad0a70ae6820d17b4b142558fc Mon Sep 17 00:00:00 2001
2From: Jonathan Bar Or <jonathanbaror@gmail.com>
3Date: Thu, 23 Jan 2025 19:17:05 +0100
4Subject: [PATCH] commands/read: Fix an integer overflow when supplying more
5 than 2^31 characters
6
7The grub_getline() function currently has a signed integer variable "i"
8that can be overflown when user supplies more than 2^31 characters.
9It results in a memory corruption of the allocated line buffer as well
10as supplying large negative values to grub_realloc().
11
12Fixes: CVE-2025-0690
13
14Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
15Signed-off-by: Jonathan Bar Or <jonathanbaror@gmail.com>
16Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
17
18CVE: CVE-2025-0690
19Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=dad8f502974ed9ad0a70ae6820d17b4b142558fc]
20Signed-off-by: Peter Marko <peter.marko@siemens.com>
21---
22 grub-core/commands/read.c | 19 +++++++++++++++----
23 1 file changed, 15 insertions(+), 4 deletions(-)
24
25diff --git a/grub-core/commands/read.c b/grub-core/commands/read.c
26index 597c90706..8d72e45c9 100644
27--- a/grub-core/commands/read.c
28+++ b/grub-core/commands/read.c
29@@ -25,6 +25,7 @@
30 #include <grub/types.h>
31 #include <grub/extcmd.h>
32 #include <grub/i18n.h>
33+#include <grub/safemath.h>
34
35 GRUB_MOD_LICENSE ("GPLv3+");
36
37@@ -37,13 +38,14 @@ static const struct grub_arg_option options[] =
38 static char *
39 grub_getline (int silent)
40 {
41- int i;
42+ grub_size_t i;
43 char *line;
44 char *tmp;
45 int c;
46+ grub_size_t alloc_size;
47
48 i = 0;
49- line = grub_malloc (1 + i + sizeof('\0'));
50+ line = grub_malloc (1 + sizeof('\0'));
51 if (! line)
52 return NULL;
53
54@@ -59,8 +61,17 @@ grub_getline (int silent)
55 line[i] = (char) c;
56 if (!silent)
57 grub_printf ("%c", c);
58- i++;
59- tmp = grub_realloc (line, 1 + i + sizeof('\0'));
60+ if (grub_add (i, 1, &i))
61+ {
62+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
63+ return NULL;
64+ }
65+ if (grub_add (i, 1 + sizeof('\0'), &alloc_size))
66+ {
67+ grub_error (GRUB_ERR_OUT_OF_RANGE, N_("overflow is detected"));
68+ return NULL;
69+ }
70+ tmp = grub_realloc (line, alloc_size);
71 if (! tmp)
72 {
73 grub_free (line);
diff --git a/meta/recipes-bsp/grub/files/CVE-2025-1118.patch b/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
deleted file mode 100644
index e6906d909c..0000000000
--- a/meta/recipes-bsp/grub/files/CVE-2025-1118.patch
+++ /dev/null
@@ -1,37 +0,0 @@
1From 34824806ac6302f91e8cabaa41308eaced25725f Mon Sep 17 00:00:00 2001
2From: B Horn <b@horn.uk>
3Date: Thu, 18 Apr 2024 20:29:39 +0100
4Subject: [PATCH] commands/minicmd: Block the dump command in lockdown mode
5
6The dump enables a user to read memory which should not be possible
7in lockdown mode.
8
9Fixes: CVE-2025-1118
10
11Reported-by: B Horn <b@horn.uk>
12Reported-by: Jonathan Bar Or <jonathanbaror@gmail.com>
13Signed-off-by: B Horn <b@horn.uk>
14Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
15
16CVE: CVE-2025-1118
17Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=34824806ac6302f91e8cabaa41308eaced25725f]
18Signed-off-by: Peter Marko <peter.marko@siemens.com>
19---
20 grub-core/commands/minicmd.c | 4 ++--
21 1 file changed, 2 insertions(+), 2 deletions(-)
22
23diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
24index 286290866..8c5ee3e60 100644
25--- a/grub-core/commands/minicmd.c
26+++ b/grub-core/commands/minicmd.c
27@@ -203,8 +203,8 @@ GRUB_MOD_INIT(minicmd)
28 grub_register_command ("help", grub_mini_cmd_help,
29 0, N_("Show this message."));
30 cmd_dump =
31- grub_register_command ("dump", grub_mini_cmd_dump,
32- N_("ADDR [SIZE]"), N_("Show memory contents."));
33+ grub_register_command_lockdown ("dump", grub_mini_cmd_dump,
34+ N_("ADDR [SIZE]"), N_("Show memory contents."));
35 cmd_rmmod =
36 grub_register_command ("rmmod", grub_mini_cmd_rmmod,
37 N_("MODULE"), N_("Remove a module."));
diff --git a/meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch b/meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch
deleted file mode 100644
index f8dfda90ab..0000000000
--- a/meta/recipes-bsp/grub/files/autogen.sh-exclude-pc.patch
+++ /dev/null
@@ -1,34 +0,0 @@
1From 14c1d0459fb3561e627d3a5f6e91a0d2f7b4aa45 Mon Sep 17 00:00:00 2001
2From: Naveen Saini <naveen.kumar.saini@intel.com>
3Date: Mon, 15 Mar 2021 14:44:15 +0800
4Subject: [PATCH] autogen.sh: exclude .pc from po/POTFILES.in
5
6Exclude the .pc from po/POTFILES.in since quilt uses "patch --backup",
7which will create the backup file under .pc, this may cause unexpected
8errors, for example, on CentOS 5.x, if the backup file is null
9(newfile), it's mode will be 000, then we will get errors when xgettext
10try to read it.
11
12Upstream-Status: Inappropriate [OE specific]
13
14Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
15Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
16Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
17
18---
19 autogen.sh | 2 +-
20 1 file changed, 1 insertion(+), 1 deletion(-)
21
22diff --git a/autogen.sh b/autogen.sh
23index 195daa5..773b7b4 100755
24--- a/autogen.sh
25+++ b/autogen.sh
26@@ -26,7 +26,7 @@ fi
27 export LC_COLLATE=C
28 unset LC_ALL
29
30-find . -iname '*.[ch]' ! -ipath './grub-core/lib/libgcrypt-grub/*' ! -ipath './build-aux/*' ! -ipath './grub-core/lib/libgcrypt/src/misc.c' ! -ipath './grub-core/lib/libgcrypt/src/global.c' ! -ipath './grub-core/lib/libgcrypt/src/secmem.c' ! -ipath './util/grub-gen-widthspec.c' ! -ipath './util/grub-gen-asciih.c' ! -ipath './gnulib/*' ! -ipath './grub-core/lib/gnulib/*' |sort > po/POTFILES.in
31+find . -iname '*.[ch]' ! -ipath './grub-core/lib/libgcrypt-grub/*' ! -ipath './build-aux/*' ! -ipath './grub-core/lib/libgcrypt/src/misc.c' ! -ipath './grub-core/lib/libgcrypt/src/global.c' ! -ipath './grub-core/lib/libgcrypt/src/secmem.c' ! -ipath './util/grub-gen-widthspec.c' ! -ipath './util/grub-gen-asciih.c' ! -ipath './gnulib/*' ! -ipath './grub-core/lib/gnulib/*' ! -path './.pc/*' |sort > po/POTFILES.in
32 find util -iname '*.in' ! -name Makefile.in |sort > po/POTFILES-shell.in
33
34 echo "Importing unicode..."
diff --git a/meta/recipes-bsp/grub/files/cfg b/meta/recipes-bsp/grub/files/cfg
deleted file mode 100644
index 8ca53d24d7..0000000000
--- a/meta/recipes-bsp/grub/files/cfg
+++ /dev/null
@@ -1,2 +0,0 @@
1search.file ($cmdpath)/EFI/BOOT/grub.cfg root
2set prefix=($root)/EFI/BOOT
diff --git a/meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch b/meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch
deleted file mode 100644
index 7c8770ce8b..0000000000
--- a/meta/recipes-bsp/grub/files/grub-module-explicitly-keeps-symbole-.module_license.patch
+++ /dev/null
@@ -1,60 +0,0 @@
1From b316ed326bd492106006d78f5bfcd767b49a4f2e Mon Sep 17 00:00:00 2001
2From: Hongxu Jia <hongxu.jia@windriver.com>
3Date: Wed, 17 Aug 2016 04:06:34 -0400
4Subject: [PATCH] grub module explicitly keeps symbole .module_license
5
6While using oe-core toolchain to strip grub module 'all_video.mod',
7it stripped symbol table:
8
9---------------
10root@localhost:~# objdump -t all_video.mod
11
12all_video.mod: file format elf64-x86-64
13
14SYMBOL TABLE:
15no symbols
16--------------
17
18It caused grub to load module all_video failed.
19--------------
20grub> insmod all_video
21error: no symbol table.
22--------------
23
24Tweak strip option to keep symbol .module_license could workaround
25the issue.
26--------------
27root@localhost:~# objdump -t all_video.mod
28
29all_video.mod: file format elf64-x86-64
30
31SYMBOL TABLE:
320000000000000000 l d .text 0000000000000000 .text
330000000000000000 l d .data 0000000000000000 .data
340000000000000000 l d .module_license 0000000000000000 .module_license
350000000000000000 l d .bss 0000000000000000 .bss
360000000000000000 l d .moddeps 0000000000000000 .moddeps
370000000000000000 l d .modname 0000000000000000 .modname
38--------------
39
40Upstream-Status: Inappropriate [workaround that needs investigation into @TARGET_STRIP@ behaviour in oe-core vs toolchain used by upstream]
41
42Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
43
44---
45 grub-core/genmod.sh.in | 2 +-
46 1 file changed, 1 insertion(+), 1 deletion(-)
47
48diff --git a/grub-core/genmod.sh.in b/grub-core/genmod.sh.in
49index e57c4d9..42bb1ba 100644
50--- a/grub-core/genmod.sh.in
51+++ b/grub-core/genmod.sh.in
52@@ -56,7 +56,7 @@ if test x@TARGET_APPLE_LINKER@ != x1; then
53 if test x@platform@ != xemu; then
54 @TARGET_STRIP@ --strip-unneeded \
55 -K grub_mod_init -K grub_mod_fini \
56- -K _grub_mod_init -K _grub_mod_fini \
57+ -K _grub_mod_init -K _grub_mod_fini -K .module_license \
58 -R .note.gnu.gold-version -R .note.GNU-stack \
59 -R .gnu.build.attributes \
60 -R .rel.gnu.build.attributes \
diff --git a/meta/recipes-bsp/grub/grub-bootconf_1.00.bb b/meta/recipes-bsp/grub/grub-bootconf_1.00.bb
deleted file mode 100644
index 0b4005e5bf..0000000000
--- a/meta/recipes-bsp/grub/grub-bootconf_1.00.bb
+++ /dev/null
@@ -1,32 +0,0 @@
1LICENSE = "MIT"
2LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
3SUMMARY = "Basic grub.cfg for use in EFI systems"
4DESCRIPTION = "Grub might require different configuration file for \
5different machines."
6HOMEPAGE = "https://www.gnu.org/software/grub/manual/grub/grub.html#Configuration"
7
8RPROVIDES:${PN} += "virtual-grub-bootconf"
9
10inherit grub-efi-cfg
11
12require conf/image-uefi.conf
13
14S = "${UNPACKDIR}"
15
16GRUB_CFG = "${S}/grub-bootconf"
17LABELS = "boot"
18
19ROOT ?= "root=/dev/sda2"
20
21python do_configure() {
22 bb.build.exec_func('build_efi_cfg', d)
23}
24
25do_configure[vardeps] += "APPEND ROOT GRUB_TITLE"
26
27do_install() {
28 install -d ${D}${EFI_FILES_PATH}
29 install grub-bootconf ${D}${EFI_FILES_PATH}/grub.cfg
30}
31
32FILES:${PN} = "${EFI_FILES_PATH}/grub.cfg"
diff --git a/meta/recipes-bsp/grub/grub-efi_2.12.bb b/meta/recipes-bsp/grub/grub-efi_2.12.bb
deleted file mode 100644
index 6354b43989..0000000000
--- a/meta/recipes-bsp/grub/grub-efi_2.12.bb
+++ /dev/null
@@ -1,110 +0,0 @@
1require grub2.inc
2
3require conf/image-uefi.conf
4
5GRUBPLATFORM = "efi"
6
7DEPENDS:append = " grub-native"
8RDEPENDS:${PN} = "grub-common virtual-grub-bootconf"
9
10SRC_URI += " \
11 file://cfg \
12 "
13
14S = "${UNPACKDIR}/grub-${PV}"
15
16# Determine the target arch for the grub modules
17python __anonymous () {
18 import re
19 target = d.getVar('TARGET_ARCH')
20 prefix = "" if d.getVar('EFI_PROVIDER') == "grub-efi" else "grub-efi-"
21 if target == "x86_64":
22 grubtarget = 'x86_64'
23 elif re.match('i.86', target):
24 grubtarget = 'i386'
25 elif re.match('aarch64', target):
26 grubtarget = 'arm64'
27 elif re.match('arm', target):
28 grubtarget = 'arm'
29 elif re.match('riscv64', target):
30 grubtarget = 'riscv64'
31 elif re.match('riscv32', target):
32 grubtarget = 'riscv32'
33 elif re.match('loongarch64', target):
34 grubtarget = 'loongarch64'
35 else:
36 raise bb.parse.SkipRecipe("grub-efi is incompatible with target %s" % target)
37 grubimage = prefix + d.getVar("EFI_BOOT_IMAGE")
38 d.setVar("GRUB_TARGET", grubtarget)
39 d.setVar("GRUB_IMAGE", grubimage)
40 prefix = "grub-efi-" if prefix == "" else ""
41 d.setVar("GRUB_IMAGE_PREFIX", prefix)
42}
43
44inherit deploy
45
46CACHED_CONFIGUREVARS += "ac_cv_path_HELP2MAN="
47EXTRA_OECONF += "--enable-efiemu=no"
48
49# Define GRUB_MKIMAGE_OPTS variable for additional grub-mkimage options (e.g., disabling shim lock)
50GRUB_MKIMAGE_OPTS ?= ""
51
52do_mkimage() {
53 cd ${B}
54
55 GRUB_MKIMAGE_MODULES="${GRUB_BUILDIN}"
56
57 # If 'all' is included in GRUB_BUILDIN we will include all available grub2 modules
58 if [ "${@ bb.utils.contains('GRUB_BUILDIN', 'all', 'True', 'False', d)}" = "True" ]; then
59 bbdebug 1 "Including all available modules"
60 # Get the list of all .mod files in grub-core build directory
61 GRUB_MKIMAGE_MODULES=$(find ${B}/grub-core/ -type f -name "*.mod" -exec basename {} .mod \;)
62 fi
63
64 # Search for the grub.cfg on the local boot media by using the
65 # built in cfg file provided via this recipe
66 grub-mkimage -v -c ${UNPACKDIR}/cfg -p ${EFIDIR} -d ./grub-core/ \
67 -O ${GRUB_TARGET}-efi -o ./${GRUB_IMAGE_PREFIX}${GRUB_IMAGE} \
68 ${GRUB_MKIMAGE_OPTS} ${GRUB_MKIMAGE_MODULES}
69}
70
71addtask mkimage before do_install after do_compile
72
73do_install() {
74 oe_runmake 'DESTDIR=${D}' -C grub-core install
75
76 # Remove build host references...
77 find "${D}" -name modinfo.sh -type f -exec \
78 sed -i \
79 -e 's,--sysroot=${STAGING_DIR_TARGET},,g' \
80 -e 's|${DEBUG_PREFIX_MAP}||g' \
81 -e 's:${RECIPE_SYSROOT_NATIVE}::g' \
82 {} +
83
84 install -d ${D}${EFI_FILES_PATH}
85 install -m 644 ${B}/${GRUB_IMAGE_PREFIX}${GRUB_IMAGE} ${D}${EFI_FILES_PATH}/${GRUB_IMAGE}
86}
87
88# To include all available modules, add 'all' to GRUB_BUILDIN
89GRUB_BUILDIN ?= "boot linux ext2 fat serial part_msdos part_gpt normal \
90 efi_gop iso9660 configfile search loadenv test"
91
92# 'xen_boot' is a module valid only for aarch64
93GRUB_BUILDIN:append:aarch64 = "${@bb.utils.contains('DISTRO_FEATURES', 'xen', ' xen_boot', '', d)}"
94
95do_deploy() {
96 install -m 644 ${B}/${GRUB_IMAGE_PREFIX}${GRUB_IMAGE} ${DEPLOYDIR}
97}
98
99addtask deploy after do_install before do_build
100
101FILES:${PN} = "${libdir}/grub/${GRUB_TARGET}-efi \
102 ${datadir}/grub \
103 ${EFI_FILES_PATH}/${GRUB_IMAGE} \
104 "
105
106# 64-bit binaries are expected for the bootloader with an x32 userland
107INSANE_SKIP:${PN}:append:linux-gnux32 = " arch"
108INSANE_SKIP:${PN}-dbg:append:linux-gnux32 = " arch"
109INSANE_SKIP:${PN}:append:linux-muslx32 = " arch"
110INSANE_SKIP:${PN}-dbg:append:linux-muslx32 = " arch"
diff --git a/meta/recipes-bsp/grub/grub2.inc b/meta/recipes-bsp/grub/grub2.inc
deleted file mode 100644
index 14edda334a..0000000000
--- a/meta/recipes-bsp/grub/grub2.inc
+++ /dev/null
@@ -1,115 +0,0 @@
1SUMMARY = "GRUB2 is the next-generation GRand Unified Bootloader"
2
3DESCRIPTION = "GRUB2 is the next generaion of a GPLed bootloader \
4intended to unify bootloading across x86 operating systems. In \
5addition to loading the Linux kernel, it implements the Multiboot \
6standard, which allows for flexible loading of multiple boot images."
7
8HOMEPAGE = "http://www.gnu.org/software/grub/"
9SECTION = "bootloaders"
10
11LICENSE = "GPL-3.0-only"
12LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
13
14CVE_PRODUCT = "grub2"
15
16SRC_URI = "${GNU_MIRROR}/grub/grub-${PV}.tar.gz \
17 file://autogen.sh-exclude-pc.patch \
18 file://grub-module-explicitly-keeps-symbole-.module_license.patch \
19 file://0001-grub.d-10_linux.in-add-oe-s-kernel-name.patch \
20 file://0001-RISC-V-Restore-the-typcast-to-long.patch \
21 file://0001-misc-Implement-grub_strlcpy.patch \
22 file://CVE-2024-45781.patch \
23 file://CVE-2024-45782_CVE-2024-56737.patch \
24 file://CVE-2024-45780.patch \
25 file://CVE-2024-45783.patch \
26 file://CVE-2025-0624.patch \
27 file://CVE-2024-45774.patch \
28 file://CVE-2024-45775.patch \
29 file://CVE-2025-0622-01.patch \
30 file://CVE-2025-0622-02.patch \
31 file://CVE-2025-0622-03.patch \
32 file://CVE-2024-45776.patch \
33 file://CVE-2024-45777.patch \
34 file://CVE-2025-0690.patch \
35 file://CVE-2025-1118.patch \
36 file://CVE-2024-45778_CVE-2024-45779.patch \
37 file://CVE-2025-0677_CVE-2025-0684_CVE-2025-0685_CVE-2025-0686_CVE-2025-0689.patch \
38 file://CVE-2025-0678_CVE-2025-1125.patch \
39 file://CVE-2024-56738.patch \
40"
41
42SRC_URI[sha256sum] = "b30919fa5be280417c17ac561bb1650f60cfb80cc6237fa1e2b6f56154cb9c91"
43
44CVE_STATUS[CVE-2019-14865] = "not-applicable-platform: applies only to RHEL"
45CVE_STATUS[CVE-2023-4001] = "not-applicable-platform: Applies only to RHEL/Fedora"
46CVE_STATUS[CVE-2024-1048] = "not-applicable-platform: Applies only to RHEL/Fedora"
47CVE_STATUS[CVE-2024-2312] = "not-applicable-platform: Applies only to Ubuntu"
48
49DEPENDS = "flex-native bison-native gettext-native"
50
51GRUB_COMPATIBLE_HOST = '(x86_64.*|i.86.*|arm.*|aarch64.*|loongarch64.*|riscv.*)-(linux.*|freebsd.*)'
52COMPATIBLE_HOST = "${GRUB_COMPATIBLE_HOST}"
53# Grub doesn't support hard float toolchain and won't be able to forcefully
54# disable it on some of the target CPUs. See 'configure.ac' for
55# supported/unsupported CPUs in hardfp.
56COMPATIBLE_HOST:armv7a = "${@'null' if bb.utils.contains('TUNE_CCARGS_MFLOAT', 'hard', True, False, d) else d.getVar('GRUB_COMPATIBLE_HOST')}"
57COMPATIBLE_HOST:armv7ve = "${@'null' if bb.utils.contains('TUNE_CCARGS_MFLOAT', 'hard', True, False, d) else d.getVar('GRUB_COMPATIBLE_HOST')}"
58
59# configure.ac has code to set this automagically from the target tuple
60# but the OE freeform one (core2-foo-bar-linux) don't work with that.
61
62GRUBPLATFORM:arm = "efi"
63GRUBPLATFORM:aarch64 = "efi"
64GRUBPLATFORM:loongarch64 = "efi"
65GRUBPLATFORM:riscv32 = "efi"
66GRUBPLATFORM:riscv64 = "efi"
67GRUBPLATFORM ??= "pc"
68
69inherit autotools gettext texinfo pkgconfig
70
71CFLAGS:remove = "-O2"
72# It doesn't support sse, its make.defaults sets:
73# CFLAGS += -mno-mmx -mno-sse
74# So also remove -mfpmath=sse from TUNE_CCARGS
75TUNE_CCARGS:remove = "-mfpmath=sse"
76TUNE_CCARGS:append:toolchain-clang = " -fuse-ld=bfd -Wno-error=unused-command-line-argument"
77
78EXTRA_OECONF = "--with-platform=${GRUBPLATFORM} \
79 --disable-grub-mkfont \
80 --program-prefix="" \
81 --enable-liblzma=no \
82 --enable-libzfs=no \
83 --enable-largefile \
84 --disable-werror \
85"
86
87PACKAGECONFIG ??= ""
88PACKAGECONFIG[grub-mount] = "--enable-grub-mount,--disable-grub-mount,fuse"
89PACKAGECONFIG[device-mapper] = "--enable-device-mapper,--disable-device-mapper,libdevmapper"
90
91# grub2 creates its own set of -nostdinc / -isystem / -ffreestanding CFLAGS and
92# OE's default BUILD_CFLAGS (assigned to CFLAGS for native builds) etc, conflict
93# with that. Note that since BUILD_CFLAGS etc are not used by grub2 target
94# builds, it's safe to clear them unconditionally for both target and native.
95BUILD_CPPFLAGS = ""
96BUILD_CFLAGS = ""
97BUILD_CXXFLAGS = ""
98BUILD_LDFLAGS = ""
99
100export PYTHON = "python3"
101
102do_configure:prepend() {
103 cd ${S}
104
105 # Remove in next version.
106 # See: https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b835601c7639ed1890f2d3db91900a8506011a8e
107 echo "depends bli part_gpt" > ${S}/grub-core/extra_deps.lst
108
109 FROM_BOOTSTRAP=1 ${S}/autogen.sh
110 cd ${B}
111}
112
113# | aarch64-poky-linux-clang: error: invalid argument '-mcmodel=large' only allowed with '-fno-pic'
114# see - https://bugs.gentoo.org/942843
115TOOLCHAIN:aarch64 = "gcc"
diff --git a/meta/recipes-bsp/grub/grub_2.12.bb b/meta/recipes-bsp/grub/grub_2.12.bb
deleted file mode 100644
index 05d462785c..0000000000
--- a/meta/recipes-bsp/grub/grub_2.12.bb
+++ /dev/null
@@ -1,41 +0,0 @@
1require grub2.inc
2
3RDEPENDS:${PN}-common += "${PN}-editenv"
4RDEPENDS:${PN} += "${PN}-common"
5RDEPENDS:${PN}:class-native = ""
6
7RPROVIDES:${PN}-editenv += "${PN}-efi-editenv"
8
9PROVIDES:append:class-native = " grub-efi-native"
10
11PACKAGES =+ "${PN}-editenv ${PN}-common"
12FILES:${PN}-editenv = "${bindir}/grub-editenv"
13FILES:${PN}-common = " \
14 ${bindir} \
15 ${sysconfdir} \
16 ${sbindir} \
17 ${datadir}/grub \
18"
19ALLOW_EMPTY:${PN} = "1"
20
21do_install:append () {
22 # Avoid conflicts with the EFI package for systems such as arm64 where we
23 # need to build grub and grub-efi but only EFI is supported by removing EFI
24 # from this package.
25 rm -rf ${D}${libdir}/grub/*-efi/
26 rmdir --ignore-fail-on-non-empty ${D}${libdir}/grub ${D}${libdir}
27
28 install -d ${D}${sysconfdir}/grub.d
29 # Remove build host references...
30 find "${D}" -name modinfo.sh -type f -exec \
31 sed -i \
32 -e 's,--sysroot=${STAGING_DIR_TARGET},,g' \
33 -e 's|${DEBUG_PREFIX_MAP}||g' \
34 -e 's:${RECIPE_SYSROOT_NATIVE}::g' \
35 {} +
36}
37
38INSANE_SKIP:${PN} = "arch"
39INSANE_SKIP:${PN}-dbg = "arch"
40
41BBCLASSEXTEND = "native nativesdk"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-25 07:16:12 +0000