B Horn
500e5fdd82
kern/dl: Fix for an integer overflow in grub_dl_ref()
...
It was possible to overflow the value of mod->ref_count, a signed
integer, by repeatedly invoking insmod on an already loaded module.
This led to a use-after-free. As once ref_count was overflowed it became
possible to unload the module while there was still references to it.
This resolves the issue by using grub_add() to check if the ref_count
will overflow and then stops further increments. Further changes were
also made to grub_dl_unref() to check for the underflow condition and
the reference count was changed to an unsigned 64-bit integer.
Reported-by: B Horn <b@horn.uk>
Signed-off-by: B Horn <b@horn.uk>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2025-02-13 15:45:55 +01:00
..
2013-01-20 15:52:15 +00:00
2024-06-06 16:55:16 +02:00
2024-10-10 13:09:06 +02:00
2024-11-28 22:37:50 +01:00
2022-03-14 15:44:26 +01:00
2024-11-28 21:50:55 +01:00
2013-12-21 03:03:31 +01:00
2023-12-13 14:21:21 +01:00
2022-03-14 15:44:26 +01:00
2024-09-05 16:08:17 +02:00
2022-07-04 14:43:25 +02:00
2022-06-07 16:39:31 +02:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2023-01-10 16:32:42 +01:00
2012-10-12 15:34:33 +01:00
2020-02-28 12:41:29 +01:00
2022-03-14 15:44:26 +01:00
2013-06-07 18:40:37 +02:00
2021-03-02 15:54:15 +01:00
2013-12-17 14:39:48 +01:00
2013-12-17 14:39:48 +01:00
2023-03-29 20:31:57 +02:00
2015-01-25 16:36:30 +03:00
2015-01-24 20:52:02 +01:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2022-11-14 17:37:51 +01:00
2018-11-09 13:25:31 +01:00
2021-03-02 15:54:15 +01:00
2022-03-14 15:44:26 +01:00
2020-04-21 22:08:52 +02:00
2024-10-31 16:08:36 +01:00
2022-07-04 14:43:25 +02:00
2023-08-14 18:12:49 +02:00
2022-03-14 15:44:26 +01:00
2015-12-15 10:25:34 +03:00
2022-03-14 15:44:26 +01:00
2022-06-07 12:51:50 +02:00
2021-03-02 15:54:15 +01:00
2023-03-07 15:26:36 +01:00
2021-03-02 15:54:17 +01:00
2025-02-13 15:45:55 +01:00
2022-03-14 15:44:26 +01:00
2022-11-14 17:17:21 +01:00
2022-03-14 15:44:26 +01:00
2012-02-08 19:26:01 +01:00
2020-02-28 12:41:29 +01:00
2022-03-14 15:44:26 +01:00
2023-06-01 11:45:00 +02:00
2022-10-04 15:38:39 +02:00
2011-12-13 15:13:51 +01:00
2023-07-03 14:10:01 +02:00
2012-02-03 11:46:18 +01:00
2012-02-03 11:46:18 +01:00
2012-02-03 11:46:18 +01:00
2022-04-04 18:07:04 +02:00
2022-04-04 18:07:04 +02:00
2021-09-06 15:08:23 +02:00
2020-04-21 22:13:44 +02:00
2020-03-10 21:35:02 +01:00
2015-01-24 21:23:25 +01:00
2022-03-14 15:44:26 +01:00
2020-02-28 12:41:29 +01:00
2022-07-04 14:43:25 +02:00
2018-11-09 13:25:31 +01:00
2012-02-12 15:25:25 +01:00
2024-10-10 13:04:37 +02:00
2015-01-24 21:25:42 +01:00
2012-03-03 12:59:28 +01:00
2019-04-23 11:37:08 +02:00
2023-08-14 18:04:04 +02:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2013-11-12 01:19:34 +01:00