tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kern/efi/mm: Fix use-after-free in finish boot services

Browse Source 
In grub-core/kern/efi/mm.c, grub_efi_finish_boot_services() has an instance
where the memory for the variable finish_mmap_buf is freed, but on the next
iteration of a while loop, grub_efi_get_memory_map() uses finish_mmap_buf. To
prevent this, we can set finish_mmap_buf to NULL after the free.

Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Alec Brown 2023-05-22 16:52:49 -04:00 committed by Daniel Kiper
parent f00ddc6834
commit 6f05a27796
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
grub-core/kern/efi/mm.c
View File

@ -263,6 +263,7 @@ grub_efi_finish_boot_services (grub_efi_uintn_t *outbuf_size, void *outbuf,
&finish_desc_size, &finish_desc_version) <= 0)
{
grub_free (finish_mmap_buf);
finish_mmap_buf = NULL;
return grub_error (GRUB_ERR_IO, "couldn't retrieve memory map");
}
@ -274,10 +275,12 @@ grub_efi_finish_boot_services (grub_efi_uintn_t *outbuf_size, void *outbuf,
if (status != GRUB_EFI_INVALID_PARAMETER)
{
grub_free (finish_mmap_buf);
finish_mmap_buf = NULL;
return grub_error (GRUB_ERR_IO, "couldn't terminate EFI services");
}
grub_free (finish_mmap_buf);
finish_mmap_buf = NULL;
grub_printf ("Trying to terminate EFI services again\n");
}
grub_efi_is_finished = 1;