Go to file
Stefan Sørensen 2f7a8021b5 boot/grub2: Backport Boothole securify fixes
Details: https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html

Fixes the following security issues:

 * CVE-2020-10713
   A flaw was found in grub2, prior to version 2.06. An attacker may
   use the GRUB 2 flaw to hijack and tamper the GRUB verification
   process. This flaw also allows the bypass of Secure Boot
   protections. In order to load an untrusted or modified kernel, an
   attacker would first need to establish access to the system such as
   gaining physical access, obtain the ability to alter a pxe-boot
   network, or have remote access to a networked system with root
   access. With this access, an attacker could then craft a string to
   cause a buffer overflow by injecting a malicious payload that leads
   to arbitrary code execution within GRUB. The highest threat from
   this vulnerability is to data confidentiality and integrity as well
   as system availability.

 * CVE-2020-14308
   In grub2 versions before 2.06 the grub memory allocator doesn't
   check for possible arithmetic overflows on the requested allocation
   size. This leads the function to return invalid memory allocations
   which can be further used to cause possible integrity,
   confidentiality and availability impacts during the boot process.

 * CVE-2020-14309
   There's an issue with grub2 in all versions before 2.06 when
   handling squashfs filesystems containing a symbolic link with name
   length of UINT32 bytes in size. The name size leads to an
   arithmetic overflow leading to a zero-size allocation further
   causing a heap-based buffer overflow with attacker controlled data.

 * CVE-2020-14310
   An integer overflow in read_section_from_string may lead to a heap
   based buffer overflow.

 * CVE-2020-14311
   An integer overflow in grub_ext2_read_link may lead to a heap-based
   buffer overflow.

 * CVE-2020-15706
   GRUB2 contains a race condition in grub_script_function_create()
   leading to a use-after-free vulnerability which can be triggered by
   redefining a function whilst the same function is already
   executing, leading to arbitrary code execution and secure boot
   restriction bypass

 * CVE-2020-15707
   Integer overflows were discovered in the functions grub_cmd_initrd
   and grub_initrd_init in the efilinux component of GRUB2, as shipped
   in Debian, Red Hat, and Ubuntu (the functionality is not included
   in GRUB2 upstream), leading to a heap-based buffer overflow. These
   could be triggered by an extremely large number of arguments to the
   initrd command on 32-bit architectures, or a crafted filesystem
   with very large files on any architecture. An attacker could use
   this to execute arbitrary code and bypass UEFI Secure Boot
   restrictions. This issue affects GRUB2 version 2.04 and prior
   versions.

Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-08-03 13:38:49 +02:00
arch arch/Config.in: add BR2_ARCH_NEEDS_GCC_AT_LEAST_10 2020-06-24 21:57:43 +02:00
board configs/bananapi_m2_zero: new defconfig 2020-07-25 23:12:34 +02:00
boot boot/grub2: Backport Boothole securify fixes 2020-08-03 13:38:49 +02:00
configs configs/stm32mp157c_dk2: Bump Kernel and U-Boot 2020-07-27 21:16:47 +02:00
docs gitlab: generate the gitlab-ci configuration before each build 2020-07-27 13:45:52 +02:00
fs fs/cpio: generate reproducible archives 2020-06-29 17:57:12 +02:00
linux {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 7}.x series 2020-07-31 09:06:47 +02:00
package package/rauc: bump version to 1.4 2020-08-03 13:35:20 +02:00
support support/testing: drop explicit docker kernel options from docker test 2020-07-31 09:13:25 +02:00
system system: replace nogroup with nobody 2020-07-18 14:18:33 +02:00
toolchain toolchain/toolchain-buildroot: enable uclibc for riscv64 2020-07-27 18:00:17 +02:00
utils utils/scancpan: use two spaces indentation in hash file 2020-03-15 23:17:46 +01:00
.defconfig
.flake8
.gitignore
.gitlab-ci.yml gitlab: generate the gitlab-ci configuration before each build 2020-07-27 13:45:52 +02:00
CHANGES Update for 2020.02.4 2020-07-26 10:42:51 +02:00
Config.in Config.in: update BR2_OPTIMIZE_FAST prompt and help text 2020-07-18 16:05:01 +02:00
Config.in.legacy package/linux-headers: drop support for 5.6.x headers 2020-07-31 09:06:44 +02:00
COPYING
DEVELOPERS package/cargo-bin: remove and use cargo-bin from rust-bin package 2020-07-27 13:31:00 +02:00
Makefile Makefile: properly account for custom tags in BR2_VERSION_FULL 2020-07-27 18:46:31 +02:00
Makefile.legacy
README

Buildroot is a simple, efficient and easy-to-use tool to generate embedded
Linux systems through cross-compilation.

The documentation can be found in docs/manual. You can generate a text
document with 'make manual-text' and read output/docs/manual/manual.text.
Online documentation can be found at http://buildroot.org/docs.html

To build and use the buildroot stuff, do the following:

1) run 'make menuconfig'
2) select the target architecture and the packages you wish to compile
3) run 'make'
4) wait while it compiles
5) find the kernel, bootloader, root filesystem, etc. in output/images

You do not need to be root to build or run buildroot.  Have fun!

Buildroot comes with a basic configuration for a number of boards. Run
'make list-defconfigs' to view the list of provided configurations.

Please feed suggestions, bug reports, insults, and bribes back to the
buildroot mailing list: buildroot@buildroot.org
You can also find us on #buildroot on Freenode IRC.

If you would like to contribute patches, please read
https://buildroot.org/manual.html#submitting-patches