From 5d6f17ba4e94fe00b80498e9ce1aac57e22adba7 Mon Sep 17 00:00:00 2001 From: Lidong Chen Date: Fri, 22 Nov 2024 06:27:55 +0000 Subject: [PATCH 10/20] commands/extcmd: Missing check for failed allocation The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate a grub_arg_list struct but it does not verify the allocation was successful. In case of failed allocation the NULL state pointer can be accessed in parse_option() through grub_arg_parse() which may lead to a security issue. Fixes: CVE-2024-45775 Reported-by: Nils Langius Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper Reviewed-by: Alec Brown --- grub-core/commands/extcmd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c index 4ac111a991..95bd71235a 100644 --- a/grub-core/commands/extcmd.c +++ b/grub-core/commands/extcmd.c @@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args, } state = grub_arg_list_alloc (ext, argc, args); + if (state == NULL) + return grub_errno; + if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc)) { context.state = state; -- 2.48.1