65c99394ff
Grub 2.06 is affected by a number of CVEs, which have been fixed in the master branch of Grub, but are not yet part of any release (there is a 2.12-rc1 release, but nothing else between 2.06 and 2.12-rc1). So this patch backports the relevant fixes for CVE-2022-28736, CVE-2022-28735, CVE-2021-3695, CVE-2021-3696, CVE-2021-3697, CVE-2022-28733, CVE-2022-28734, CVE-2022-2601 and CVE-2022-3775. It should be noted that CVE-2021-3695, CVE-2021-3696, CVE-2021-3697 are not reported as affecting Grub by our CVE matching logic because the NVD database uses an incorrect CPE ID in those CVEs: it uses "grub" as the product instead of "grub2" like all other CVEs for grub. This issue has been reported to the NVD maintainers. This requires backporting a lot of patches, but jumping from 2.06 to 2.12-rc1 implies getting 592 commits, which is quite a lot. All Grub test cases are working fine: https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500585 https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500679 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [Arnout: fix check-package warning in patch 0002] Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
51 lines
1.7 KiB
Diff
51 lines
1.7 KiB
Diff
From 6bb49bda656e1121fd303cf3e69709172e267718 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Axtens <dja@axtens.net>
|
|
Date: Tue, 8 Mar 2022 18:17:03 +1100
|
|
Subject: [PATCH] net/http: Fix OOB write for split http headers
|
|
|
|
GRUB has special code for handling an http header that is split
|
|
across two packets.
|
|
|
|
The code tracks the end of line by looking for a "\n" byte. The
|
|
code for split headers has always advanced the pointer just past the
|
|
end of the line, whereas the code that handles unsplit headers does
|
|
not advance the pointer. This extra advance causes the length to be
|
|
one greater, which breaks an assumption in parse_line(), leading to
|
|
it writing a NUL byte one byte past the end of the buffer where we
|
|
reconstruct the line from the two packets.
|
|
|
|
It's conceivable that an attacker controlled set of packets could
|
|
cause this to zero out the first byte of the "next" pointer of the
|
|
grub_mm_region structure following the current_line buffer.
|
|
|
|
Do not advance the pointer in the split header case.
|
|
|
|
Fixes: CVE-2022-28734
|
|
|
|
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
Upstream: ec6bfd3237394c1c7dbf2fd73417173318d22f4b
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
|
|
---
|
|
grub-core/net/http.c | 4 +---
|
|
1 file changed, 1 insertion(+), 3 deletions(-)
|
|
|
|
diff --git a/grub-core/net/http.c b/grub-core/net/http.c
|
|
index b616cf40b..a19b0a205 100644
|
|
--- a/grub-core/net/http.c
|
|
+++ b/grub-core/net/http.c
|
|
@@ -190,9 +190,7 @@ http_receive (grub_net_tcp_socket_t sock __attribute__ ((unused)),
|
|
int have_line = 1;
|
|
char *t;
|
|
ptr = grub_memchr (nb->data, '\n', nb->tail - nb->data);
|
|
- if (ptr)
|
|
- ptr++;
|
|
- else
|
|
+ if (ptr == NULL)
|
|
{
|
|
have_line = 0;
|
|
ptr = (char *) nb->tail;
|
|
--
|
|
2.41.0
|
|
|