forked from pool/grub2
e016790fe1
- Security fixes and hardenings for boothole 3 / boothole 2022 (bsc#1198581) * 0001-video-Remove-trailing-whitespaces.patch * 0002-loader-efi-chainloader-Simplify-the-loader-state.patch * 0003-commands-boot-Add-API-to-pass-context-to-loader.patch - Fix CVE-2022-28736 (bsc#1198496) * 0004-loader-efi-chainloader-Use-grub_loader_set_ex.patch - Fix CVE-2022-28735 (bsc#1198495) * 0005-kern-efi-sb-Reject-non-kernel-files-in-the-shim_lock.patch * 0006-kern-file-Do-not-leak-device_name-on-error-in-grub_f.patch * 0007-video-readers-png-Abort-sooner-if-a-read-operation-f.patch * 0008-video-readers-png-Refuse-to-handle-multiple-image-he.patch - Fix CVE-2021-3695 (bsc#1191184) * 0009-video-readers-png-Drop-greyscale-support-to-fix-heap.patch - Fix CVE-2021-3696 (bsc#1191185) * 0010-video-readers-png-Avoid-heap-OOB-R-W-inserting-huff-.patch * 0011-video-readers-png-Sanity-check-some-huffman-codes.patch * 0012-video-readers-jpeg-Abort-sooner-if-a-read-operation-.patch * 0013-video-readers-jpeg-Do-not-reallocate-a-given-huff-ta.patch * 0014-video-readers-jpeg-Refuse-to-handle-multiple-start-o.patch - Fix CVE-2021-3697 (bsc#1191186) * 0015-video-readers-jpeg-Block-int-underflow-wild-pointer-.patch * 0016-normal-charset-Fix-array-out-of-bounds-formatting-un.patch - Fix CVE-2022-28733 (bsc#1198460) * 0017-net-ip-Do-IP-fragment-maths-safely.patch * 0018-net-netbuff-Block-overly-large-netbuff-allocs.patch * 0019-net-dns-Fix-double-free-addresses-on-corrupt-DNS-res.patch * 0020-net-dns-Don-t-read-past-the-end-of-the-string-we-re-.patch * 0021-net-tftp-Prevent-a-UAF-and-double-free-from-a-failed.patch * 0022-net-tftp-Avoid-a-trivial-UAF.patch * 0023-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch OBS-URL: https://build.opensuse.org/request/show/981228 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=416
104 lines
3.5 KiB
Diff
104 lines
3.5 KiB
Diff
From ee99e452b9c1aafd3eb80592830ae2c6f69eb395 Mon Sep 17 00:00:00 2001
|
|
From: Julian Andres Klode <julian.klode@canonical.com>
|
|
Date: Thu, 2 Dec 2021 15:03:53 +0100
|
|
Subject: [PATCH 05/32] kern/efi/sb: Reject non-kernel files in the shim_lock
|
|
verifier
|
|
|
|
We must not allow other verifiers to pass things like the GRUB modules.
|
|
Instead of maintaining a blocklist, maintain an allowlist of things
|
|
that we do not care about.
|
|
|
|
This allowlist really should be made reusable, and shared by the
|
|
lockdown verifier, but this is the minimal patch addressing
|
|
security concerns where the TPM verifier was able to mark modules
|
|
as verified (or the OpenPGP verifier for that matter), when it
|
|
should not do so on shim-powered secure boot systems.
|
|
|
|
Fixes: CVE-2022-28735
|
|
|
|
Signed-off-by: Julian Andres Klode <julian.klode@canonical.com>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
---
|
|
grub-core/kern/efi/sb.c | 39 ++++++++++++++++++++++++++++++++++++---
|
|
include/grub/verify.h | 1 +
|
|
2 files changed, 37 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/grub-core/kern/efi/sb.c b/grub-core/kern/efi/sb.c
|
|
index c52ec6226a..89c4bb3fd1 100644
|
|
--- a/grub-core/kern/efi/sb.c
|
|
+++ b/grub-core/kern/efi/sb.c
|
|
@@ -119,10 +119,11 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
|
|
void **context __attribute__ ((unused)),
|
|
enum grub_verify_flags *flags)
|
|
{
|
|
- *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
|
|
+ *flags = GRUB_VERIFY_FLAGS_NONE;
|
|
|
|
switch (type & GRUB_FILE_TYPE_MASK)
|
|
{
|
|
+ /* Files we check. */
|
|
case GRUB_FILE_TYPE_LINUX_KERNEL:
|
|
case GRUB_FILE_TYPE_MULTIBOOT_KERNEL:
|
|
case GRUB_FILE_TYPE_BSD_KERNEL:
|
|
@@ -130,11 +131,43 @@ shim_lock_verifier_init (grub_file_t io __attribute__ ((unused)),
|
|
case GRUB_FILE_TYPE_PLAN9_KERNEL:
|
|
case GRUB_FILE_TYPE_EFI_CHAINLOADED_IMAGE:
|
|
*flags = GRUB_VERIFY_FLAGS_SINGLE_CHUNK;
|
|
+ return GRUB_ERR_NONE;
|
|
|
|
- /* Fall through. */
|
|
+ /* Files that do not affect secureboot state. */
|
|
+ case GRUB_FILE_TYPE_NONE:
|
|
+ case GRUB_FILE_TYPE_LOOPBACK:
|
|
+ case GRUB_FILE_TYPE_LINUX_INITRD:
|
|
+ case GRUB_FILE_TYPE_OPENBSD_RAMDISK:
|
|
+ case GRUB_FILE_TYPE_XNU_RAMDISK:
|
|
+ case GRUB_FILE_TYPE_SIGNATURE:
|
|
+ case GRUB_FILE_TYPE_PUBLIC_KEY:
|
|
+ case GRUB_FILE_TYPE_PUBLIC_KEY_TRUST:
|
|
+ case GRUB_FILE_TYPE_PRINT_BLOCKLIST:
|
|
+ case GRUB_FILE_TYPE_TESTLOAD:
|
|
+ case GRUB_FILE_TYPE_GET_SIZE:
|
|
+ case GRUB_FILE_TYPE_FONT:
|
|
+ case GRUB_FILE_TYPE_ZFS_ENCRYPTION_KEY:
|
|
+ case GRUB_FILE_TYPE_CAT:
|
|
+ case GRUB_FILE_TYPE_HEXCAT:
|
|
+ case GRUB_FILE_TYPE_CMP:
|
|
+ case GRUB_FILE_TYPE_HASHLIST:
|
|
+ case GRUB_FILE_TYPE_TO_HASH:
|
|
+ case GRUB_FILE_TYPE_KEYBOARD_LAYOUT:
|
|
+ case GRUB_FILE_TYPE_PIXMAP:
|
|
+ case GRUB_FILE_TYPE_GRUB_MODULE_LIST:
|
|
+ case GRUB_FILE_TYPE_CONFIG:
|
|
+ case GRUB_FILE_TYPE_THEME:
|
|
+ case GRUB_FILE_TYPE_GETTEXT_CATALOG:
|
|
+ case GRUB_FILE_TYPE_FS_SEARCH:
|
|
+ case GRUB_FILE_TYPE_LOADENV:
|
|
+ case GRUB_FILE_TYPE_SAVEENV:
|
|
+ case GRUB_FILE_TYPE_VERIFY_SIGNATURE:
|
|
+ *flags = GRUB_VERIFY_FLAGS_SKIP_VERIFICATION;
|
|
+ return GRUB_ERR_NONE;
|
|
|
|
+ /* Other files. */
|
|
default:
|
|
- return GRUB_ERR_NONE;
|
|
+ return grub_error (GRUB_ERR_ACCESS_DENIED, N_("prohibited by secure boot policy"));
|
|
}
|
|
}
|
|
|
|
diff --git a/include/grub/verify.h b/include/grub/verify.h
|
|
index 6fde244fc6..67448165f4 100644
|
|
--- a/include/grub/verify.h
|
|
+++ b/include/grub/verify.h
|
|
@@ -24,6 +24,7 @@
|
|
|
|
enum grub_verify_flags
|
|
{
|
|
+ GRUB_VERIFY_FLAGS_NONE = 0,
|
|
GRUB_VERIFY_FLAGS_SKIP_VERIFICATION = 1,
|
|
GRUB_VERIFY_FLAGS_SINGLE_CHUNK = 2,
|
|
/* Defer verification to another authority. */
|
|
--
|
|
2.34.1
|
|
|