2f7a8021b5
Details: https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html Fixes the following security issues: * CVE-2020-10713 A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. * CVE-2020-14308 In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process. * CVE-2020-14309 There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data. * CVE-2020-14310 An integer overflow in read_section_from_string may lead to a heap based buffer overflow. * CVE-2020-14311 An integer overflow in grub_ext2_read_link may lead to a heap-based buffer overflow. * CVE-2020-15706 GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass * CVE-2020-15707 Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
284 lines
7.9 KiB
Diff
284 lines
7.9 KiB
Diff
From b6c4a1b204740fe52b32e7f530831a59f4038e20 Mon Sep 17 00:00:00 2001
|
|
From: Alexey Makhalov <amakhalov@vmware.com>
|
|
Date: Thu, 9 Jul 2020 08:10:40 +0000
|
|
Subject: [PATCH] tftp: Do not use priority queue
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
There is not need to reassemble the order of blocks. Per RFC 1350,
|
|
server must wait for the ACK, before sending next block. Data packets
|
|
can be served immediately without putting them to priority queue.
|
|
|
|
Logic to handle incoming packet is this:
|
|
- if packet block id equal to expected block id, then
|
|
process the packet,
|
|
- if packet block id is less than expected - this is retransmit
|
|
of old packet, then ACK it and drop the packet,
|
|
- if packet block id is more than expected - that shouldn't
|
|
happen, just drop the packet.
|
|
|
|
It makes the tftp receive path code simpler, smaller and faster.
|
|
As a benefit, this change fixes CID# 73624 and CID# 96690, caused
|
|
by following while loop:
|
|
|
|
while (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) == 0)
|
|
|
|
where tftph pointer is not moving from one iteration to another, causing
|
|
to serve same packet again. Luckily, double serving didn't happen due to
|
|
data->block++ during the first iteration.
|
|
|
|
Fixes: CID 73624, CID 96690
|
|
|
|
Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
|
|
---
|
|
grub-core/net/tftp.c | 168 ++++++++++++++-----------------------------
|
|
1 file changed, 53 insertions(+), 115 deletions(-)
|
|
|
|
diff --git a/grub-core/net/tftp.c b/grub-core/net/tftp.c
|
|
index 7d90bf66e..b4297bc8d 100644
|
|
--- a/grub-core/net/tftp.c
|
|
+++ b/grub-core/net/tftp.c
|
|
@@ -25,7 +25,6 @@
|
|
#include <grub/mm.h>
|
|
#include <grub/dl.h>
|
|
#include <grub/file.h>
|
|
-#include <grub/priority_queue.h>
|
|
#include <grub/i18n.h>
|
|
|
|
GRUB_MOD_LICENSE ("GPLv3+");
|
|
@@ -106,31 +105,8 @@ typedef struct tftp_data
|
|
int have_oack;
|
|
struct grub_error_saved save_err;
|
|
grub_net_udp_socket_t sock;
|
|
- grub_priority_queue_t pq;
|
|
} *tftp_data_t;
|
|
|
|
-static int
|
|
-cmp_block (grub_uint16_t a, grub_uint16_t b)
|
|
-{
|
|
- grub_int16_t i = (grub_int16_t) (a - b);
|
|
- if (i > 0)
|
|
- return +1;
|
|
- if (i < 0)
|
|
- return -1;
|
|
- return 0;
|
|
-}
|
|
-
|
|
-static int
|
|
-cmp (const void *a__, const void *b__)
|
|
-{
|
|
- struct grub_net_buff *a_ = *(struct grub_net_buff **) a__;
|
|
- struct grub_net_buff *b_ = *(struct grub_net_buff **) b__;
|
|
- struct tftphdr *a = (struct tftphdr *) a_->data;
|
|
- struct tftphdr *b = (struct tftphdr *) b_->data;
|
|
- /* We want the first elements to be on top. */
|
|
- return -cmp_block (grub_be_to_cpu16 (a->u.data.block), grub_be_to_cpu16 (b->u.data.block));
|
|
-}
|
|
-
|
|
static grub_err_t
|
|
ack (tftp_data_t data, grub_uint64_t block)
|
|
{
|
|
@@ -207,73 +183,60 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)),
|
|
return GRUB_ERR_NONE;
|
|
}
|
|
|
|
- err = grub_priority_queue_push (data->pq, &nb);
|
|
- if (err)
|
|
- return err;
|
|
-
|
|
- {
|
|
- struct grub_net_buff **nb_top_p, *nb_top;
|
|
- while (1)
|
|
- {
|
|
- nb_top_p = grub_priority_queue_top (data->pq);
|
|
- if (!nb_top_p)
|
|
- return GRUB_ERR_NONE;
|
|
- nb_top = *nb_top_p;
|
|
- tftph = (struct tftphdr *) nb_top->data;
|
|
- if (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) >= 0)
|
|
- break;
|
|
- ack (data, grub_be_to_cpu16 (tftph->u.data.block));
|
|
- grub_netbuff_free (nb_top);
|
|
- grub_priority_queue_pop (data->pq);
|
|
- }
|
|
- while (cmp_block (grub_be_to_cpu16 (tftph->u.data.block), data->block + 1) == 0)
|
|
- {
|
|
- unsigned size;
|
|
-
|
|
- grub_priority_queue_pop (data->pq);
|
|
-
|
|
- if (file->device->net->packs.count < 50)
|
|
+ /* Ack old/retransmitted block. */
|
|
+ if (grub_be_to_cpu16 (tftph->u.data.block) < data->block + 1)
|
|
+ ack (data, grub_be_to_cpu16 (tftph->u.data.block));
|
|
+ /* Ignore unexpected block. */
|
|
+ else if (grub_be_to_cpu16 (tftph->u.data.block) > data->block + 1)
|
|
+ grub_dprintf ("tftp", "TFTP unexpected block # %d\n", tftph->u.data.block);
|
|
+ else
|
|
+ {
|
|
+ unsigned size;
|
|
+
|
|
+ if (file->device->net->packs.count < 50)
|
|
+ {
|
|
err = ack (data, data->block + 1);
|
|
- else
|
|
- {
|
|
- file->device->net->stall = 1;
|
|
- err = 0;
|
|
- }
|
|
- if (err)
|
|
- return err;
|
|
-
|
|
- err = grub_netbuff_pull (nb_top, sizeof (tftph->opcode) +
|
|
- sizeof (tftph->u.data.block));
|
|
- if (err)
|
|
- return err;
|
|
- size = nb_top->tail - nb_top->data;
|
|
-
|
|
- data->block++;
|
|
- if (size < data->block_size)
|
|
- {
|
|
- if (data->ack_sent < data->block)
|
|
- ack (data, data->block);
|
|
- file->device->net->eof = 1;
|
|
- file->device->net->stall = 1;
|
|
- grub_net_udp_close (data->sock);
|
|
- data->sock = NULL;
|
|
- }
|
|
- /* Prevent garbage in broken cards. Is it still necessary
|
|
- given that IP implementation has been fixed?
|
|
- */
|
|
- if (size > data->block_size)
|
|
- {
|
|
- err = grub_netbuff_unput (nb_top, size - data->block_size);
|
|
- if (err)
|
|
- return err;
|
|
- }
|
|
- /* If there is data, puts packet in socket list. */
|
|
- if ((nb_top->tail - nb_top->data) > 0)
|
|
- grub_net_put_packet (&file->device->net->packs, nb_top);
|
|
- else
|
|
- grub_netbuff_free (nb_top);
|
|
- }
|
|
- }
|
|
+ if (err)
|
|
+ return err;
|
|
+ }
|
|
+ else
|
|
+ file->device->net->stall = 1;
|
|
+
|
|
+ err = grub_netbuff_pull (nb, sizeof (tftph->opcode) +
|
|
+ sizeof (tftph->u.data.block));
|
|
+ if (err)
|
|
+ return err;
|
|
+ size = nb->tail - nb->data;
|
|
+
|
|
+ data->block++;
|
|
+ if (size < data->block_size)
|
|
+ {
|
|
+ if (data->ack_sent < data->block)
|
|
+ ack (data, data->block);
|
|
+ file->device->net->eof = 1;
|
|
+ file->device->net->stall = 1;
|
|
+ grub_net_udp_close (data->sock);
|
|
+ data->sock = NULL;
|
|
+ }
|
|
+ /*
|
|
+ * Prevent garbage in broken cards. Is it still necessary
|
|
+ * given that IP implementation has been fixed?
|
|
+ */
|
|
+ if (size > data->block_size)
|
|
+ {
|
|
+ err = grub_netbuff_unput (nb, size - data->block_size);
|
|
+ if (err)
|
|
+ return err;
|
|
+ }
|
|
+ /* If there is data, puts packet in socket list. */
|
|
+ if ((nb->tail - nb->data) > 0)
|
|
+ {
|
|
+ grub_net_put_packet (&file->device->net->packs, nb);
|
|
+ /* Do not free nb. */
|
|
+ return GRUB_ERR_NONE;
|
|
+ }
|
|
+ }
|
|
+ grub_netbuff_free (nb);
|
|
return GRUB_ERR_NONE;
|
|
case TFTP_ERROR:
|
|
data->have_oack = 1;
|
|
@@ -287,19 +250,6 @@ tftp_receive (grub_net_udp_socket_t sock __attribute__ ((unused)),
|
|
}
|
|
}
|
|
|
|
-static void
|
|
-destroy_pq (tftp_data_t data)
|
|
-{
|
|
- struct grub_net_buff **nb_p;
|
|
- while ((nb_p = grub_priority_queue_top (data->pq)))
|
|
- {
|
|
- grub_netbuff_free (*nb_p);
|
|
- grub_priority_queue_pop (data->pq);
|
|
- }
|
|
-
|
|
- grub_priority_queue_destroy (data->pq);
|
|
-}
|
|
-
|
|
static grub_err_t
|
|
tftp_open (struct grub_file *file, const char *filename)
|
|
{
|
|
@@ -372,17 +322,9 @@ tftp_open (struct grub_file *file, const char *filename)
|
|
file->not_easily_seekable = 1;
|
|
file->data = data;
|
|
|
|
- data->pq = grub_priority_queue_new (sizeof (struct grub_net_buff *), cmp);
|
|
- if (!data->pq)
|
|
- {
|
|
- grub_free (data);
|
|
- return grub_errno;
|
|
- }
|
|
-
|
|
err = grub_net_resolve_address (file->device->net->server, &addr);
|
|
if (err)
|
|
{
|
|
- destroy_pq (data);
|
|
grub_free (data);
|
|
return err;
|
|
}
|
|
@@ -392,7 +334,6 @@ tftp_open (struct grub_file *file, const char *filename)
|
|
file);
|
|
if (!data->sock)
|
|
{
|
|
- destroy_pq (data);
|
|
grub_free (data);
|
|
return grub_errno;
|
|
}
|
|
@@ -406,7 +347,6 @@ tftp_open (struct grub_file *file, const char *filename)
|
|
if (err)
|
|
{
|
|
grub_net_udp_close (data->sock);
|
|
- destroy_pq (data);
|
|
grub_free (data);
|
|
return err;
|
|
}
|
|
@@ -423,7 +363,6 @@ tftp_open (struct grub_file *file, const char *filename)
|
|
if (grub_errno)
|
|
{
|
|
grub_net_udp_close (data->sock);
|
|
- destroy_pq (data);
|
|
grub_free (data);
|
|
return grub_errno;
|
|
}
|
|
@@ -466,7 +405,6 @@ tftp_close (struct grub_file *file)
|
|
grub_print_error ();
|
|
grub_net_udp_close (data->sock);
|
|
}
|
|
- destroy_pq (data);
|
|
grub_free (data);
|
|
return GRUB_ERR_NONE;
|
|
}
|
|
--
|
|
2.26.2
|
|
|