tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net/bootp: Prevent a UAF in network interface unregister

Browse Source 
A UAF occurs in grub_net_network_level_interface_unregister()
when inter->name is accessed after being freed in grub_cmd_bootp().
Fix it by deferring grub_free(ifaces[j].name) until after
grub_net_network_level_interface_unregister() completes.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen 2025-10-21 21:20:03 +00:00 committed by Daniel Kiper
parent fca6c0afda
commit cd24e25910
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
grub-core/net/bootp.c
View File

@ -901,14 +901,17 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)),
err = GRUB_ERR_NONE;
for (j = 0; j < ncards; j++)
{
grub_free (ifaces[j].name);
if (!ifaces[j].prev)
continue;
{
grub_free (ifaces[j].name);
continue;
}
grub_error_push ();
grub_net_network_level_interface_unregister (&ifaces[j]);
err = grub_error (GRUB_ERR_FILE_NOT_FOUND,
N_("couldn't autoconfigure %s"),
ifaces[j].card->name);
grub_free (ifaces[j].name);
}
grub_free (ifaces);