65c99394ff
Grub 2.06 is affected by a number of CVEs, which have been fixed in the master branch of Grub, but are not yet part of any release (there is a 2.12-rc1 release, but nothing else between 2.06 and 2.12-rc1). So this patch backports the relevant fixes for CVE-2022-28736, CVE-2022-28735, CVE-2021-3695, CVE-2021-3696, CVE-2021-3697, CVE-2022-28733, CVE-2022-28734, CVE-2022-2601 and CVE-2022-3775. It should be noted that CVE-2021-3695, CVE-2021-3696, CVE-2021-3697 are not reported as affecting Grub by our CVE matching logic because the NVD database uses an incorrect CPE ID in those CVEs: it uses "grub" as the product instead of "grub2" like all other CVEs for grub. This issue has been reported to the NVD maintainers. This requires backporting a lot of patches, but jumping from 2.06 to 2.12-rc1 implies getting 592 commits, which is quite a lot. All Grub test cases are working fine: https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500585 https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500679 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [Arnout: fix check-package warning in patch 0002] Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
53 lines
1.6 KiB
Diff
53 lines
1.6 KiB
Diff
From 2974684d2f7f85a5c57af8155cc3b70c04ec1d6b Mon Sep 17 00:00:00 2001
|
|
From: Daniel Axtens <dja@axtens.net>
|
|
Date: Tue, 8 Mar 2022 19:04:40 +1100
|
|
Subject: [PATCH] net/http: Error out on headers with LF without CR
|
|
|
|
In a similar vein to the previous patch, parse_line() would write
|
|
a NUL byte past the end of the buffer if there was an HTTP header
|
|
with a LF rather than a CRLF.
|
|
|
|
RFC-2616 says:
|
|
|
|
Many HTTP/1.1 header field values consist of words separated by LWS
|
|
or special characters. These special characters MUST be in a quoted
|
|
string to be used within a parameter value (as defined in section 3.6).
|
|
|
|
We don't support quoted sections or continuation lines, etc.
|
|
|
|
If we see an LF that's not part of a CRLF, bail out.
|
|
|
|
Fixes: CVE-2022-28734
|
|
|
|
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
Upstream: b26b4c08e7119281ff30d0fb4a6169bd2afa8fe4
|
|
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
|
|
---
|
|
grub-core/net/http.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/grub-core/net/http.c b/grub-core/net/http.c
|
|
index a19b0a205..1fa62b5cb 100644
|
|
--- a/grub-core/net/http.c
|
|
+++ b/grub-core/net/http.c
|
|
@@ -68,7 +68,15 @@ parse_line (grub_file_t file, http_data_t data, char *ptr, grub_size_t len)
|
|
char *end = ptr + len;
|
|
while (end > ptr && *(end - 1) == '\r')
|
|
end--;
|
|
+
|
|
+ /* LF without CR. */
|
|
+ if (end == ptr + len)
|
|
+ {
|
|
+ data->errmsg = grub_strdup (_("invalid HTTP header - LF without CR"));
|
|
+ return GRUB_ERR_NONE;
|
|
+ }
|
|
*end = 0;
|
|
+
|
|
/* Trailing CRLF. */
|
|
if (data->in_chunk_len == 1)
|
|
{
|
|
--
|
|
2.41.0
|
|
|