tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fs/bfs: Disable under lockdown

Browse Source 
The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown.
This will also disable the AFS.

Fixes: CVE-2024-45778
Fixes: CVE-2024-45779

Reported-by: Nils Langius <nils@langius.de>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens 2024-03-23 15:59:43 +11:00 committed by Daniel Kiper
parent 5f31164aed
commit 26db660503
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
grub-core/fs/bfs.c
View File

@ -30,6 +30,7 @@
#include <grub/types.h>
#include <grub/i18n.h>
#include <grub/fshelp.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+");
@ -1106,8 +1107,11 @@ GRUB_MOD_INIT (bfs)
{
COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE ==
sizeof (struct grub_bfs_extent));
grub_bfs_fs.mod = mod;
grub_fs_register (&grub_bfs_fs);
if (!grub_is_lockdown ())
{
grub_bfs_fs.mod = mod;
grub_fs_register (&grub_bfs_fs);
}
}
#ifdef MODE_AFS
@ -1116,5 +1120,6 @@ GRUB_MOD_FINI (afs)
GRUB_MOD_FINI (bfs)
#endif
{
grub_fs_unregister (&grub_bfs_fs);
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_bfs_fs);
}