tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net: Fix OOB write in grub_net_search_config_file()

Browse Source 
The function included a call to grub_strcpy() which copied data from an
environment variable to a buffer allocated in grub_cmd_normal(). The
grub_cmd_normal() didn't consider the length of the environment variable.
So, the copy operation could exceed the allocation and lead to an OOB
write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and
pass the underlying buffers size to the grub_net_search_config_file().

Fixes: CVE-2025-0624

Reported-by: B Horn <b@horn.uk>
Signed-off-by: B Horn <b@horn.uk>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
B Horn 2024-11-15 13:12:09 +00:00 committed by Daniel Kiper
parent aa8b4d7fac
commit 5eef881528
3 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
grub-core/net/net.c
View File

@ -1941,14 +1941,15 @@ grub_config_search_through (char *config, char *suffix,
}
grub_err_t
grub_net_search_config_file (char *config)
grub_net_search_config_file (char *config, grub_size_t config_buf_len)
{
grub_size_t config_len;
grub_size_t config_len, suffix_len;
char *suffix;
config_len = grub_strlen (config);
config[config_len] = '-';
suffix = config + config_len + 1;
suffix_len = config_buf_len - (config_len + 1);
struct grub_net_network_level_interface *inf;
FOR_NET_NETWORK_LEVEL_INTERFACES (inf)
@ -1974,7 +1975,7 @@ grub_net_search_config_file (char *config)
if (client_uuid)
{
grub_strcpy (suffix, client_uuid);
grub_strlcpy (suffix, client_uuid, suffix_len);
if (grub_config_search_through (config, suffix, 1, 0) == 0)
return GRUB_ERR_NONE;
}

2
grub-core/normal/main.c
View File

@ -344,7 +344,7 @@ grub_cmd_normal (struct grub_command *cmd __attribute__ ((unused)),
if (grub_strncmp (prefix + 1, "tftp", sizeof ("tftp") - 1) == 0 &&
!disable_net_search)
grub_net_search_config_file (config);
grub_net_search_config_file (config, config_len);
grub_enter_normal_mode (config);
grub_free (config);

2
include/grub/net.h
View File

@ -570,7 +570,7 @@ void
grub_net_remove_dns_server (const struct grub_net_network_level_address *s);
grub_err_t
grub_net_search_config_file (char *config);
grub_net_search_config_file (char *config, grub_size_t config_buf_len);
extern char *grub_net_default_server;