You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
71 lines
2.6 KiB
71 lines
2.6 KiB
2 years ago
|
From d298b41f90cbf1f2e5a10e29daa1fc92ddee52c9 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
||
|
|
Date: Wed, 14 Oct 2020 16:33:42 +0200
|
||
|
|
Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown
|
||
|
|
is enforced
|
||
|
|
|
||
|
|
The cutmem and badram commands can be used to remove EFI memory regions
|
||
|
|
and potentially disable the UEFI Secure Boot. Prevent the commands to be
|
||
|
|
registered if the GRUB is locked down.
|
||
|
|
|
||
|
|
Fixes: CVE-2020-27779
|
||
|
|
|
||
|
|
Reported-by: Teddy Reed <teddy.reed@gmail.com>
|
||
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
||
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
||
|
|
Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
|
||
|
|
---
|
||
|
|
docs/grub.texi | 4 ++++
|
||
|
|
grub-core/mmap/mmap.c | 13 +++++++------
|
||
|
|
2 files changed, 11 insertions(+), 6 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/docs/grub.texi b/docs/grub.texi
|
||
|
|
index 98592d3..f2fe149 100644
|
||
|
|
--- a/docs/grub.texi
|
||
|
|
+++ b/docs/grub.texi
|
||
|
|
@@ -4051,6 +4051,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns
|
||
|
|
that are often result of memory damage, due to physical distribution of memory
|
||
|
|
cells.
|
||
|
|
|
||
|
|
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
|
||
|
|
+ This prevents removing EFI memory regions to potentially subvert the
|
||
|
|
+ security mechanisms provided by the UEFI secure boot.
|
||
|
|
+
|
||
|
|
@node blocklist
|
||
|
|
@subsection blocklist
|
||
|
|
|
||
|
|
diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
|
||
|
|
index 57b4e9a..7ebf32e 100644
|
||
|
|
--- a/grub-core/mmap/mmap.c
|
||
|
|
+++ b/grub-core/mmap/mmap.c
|
||
|
|
@@ -20,6 +20,7 @@
|
||
|
|
#include <grub/memory.h>
|
||
|
|
#include <grub/machine/memory.h>
|
||
|
|
#include <grub/err.h>
|
||
|
|
+#include <grub/lockdown.h>
|
||
|
|
#include <grub/misc.h>
|
||
|
|
#include <grub/mm.h>
|
||
|
|
#include <grub/command.h>
|
||
|
|
@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
|
||
|
|
|
||
|
|
GRUB_MOD_INIT(mmap)
|
||
|
|
{
|
||
|
|
- cmd = grub_register_command ("badram", grub_cmd_badram,
|
||
|
|
- N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
||
|
|
- N_("Declare memory regions as faulty (badram)."));
|
||
|
|
- cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
|
||
|
|
- N_("FROM[K|M|G] TO[K|M|G]"),
|
||
|
|
- N_("Remove any memory regions in specified range."));
|
||
|
|
+ cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
|
||
|
|
+ N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
||
|
|
+ N_("Declare memory regions as faulty (badram)."));
|
||
|
|
+ cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
|
||
|
|
+ N_("FROM[K|M|G] TO[K|M|G]"),
|
||
|
|
+ N_("Remove any memory regions in specified range."));
|
||
|
|
|
||
|
|
}
|
||
|
|
|
||
|
|
--
|
||
|
|
2.14.2
|
||
|
|
|