proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-07-20 08:02:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

mmap: Don't register cutmem and badram commands when lockdown is enforced

Browse Source 
The cutmem and badram commands can be used to remove EFI memory regions
and potentially disable the UEFI Secure Boot. Prevent the commands to be
registered if the GRUB is locked down.

Fixes: CVE-2020-27779

Reported-by: Teddy Reed <teddy.reed@gmail.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Javier Martinez Canillas 2020-10-14 16:33:42 +02:00 committed by Daniel Kiper
parent 3e8e4c0549
commit d298b41f90
2 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/grub.texi
View File

@ -4139,6 +4139,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns
that are often result of memory damage, due to physical distribution of memory that are often result of memory damage, due to physical distribution of memory
cells. cells.
Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
This prevents removing EFI memory regions to potentially subvert the
security mechanisms provided by the UEFI secure boot.
@node blocklist @node blocklist
@subsection blocklist @subsection blocklist

13
grub-core/mmap/mmap.c
View File

@ -20,6 +20,7 @@
#include <grub/memory.h> #include <grub/memory.h>
#include <grub/machine/memory.h> #include <grub/machine/memory.h>
#include <grub/err.h> #include <grub/err.h>
#include <grub/lockdown.h>
#include <grub/misc.h> #include <grub/misc.h>
#include <grub/mm.h> #include <grub/mm.h>
#include <grub/command.h> #include <grub/command.h>
@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
GRUB_MOD_INIT(mmap) GRUB_MOD_INIT(mmap)
{ {
cmd = grub_register_command ("badram", grub_cmd_badram, cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"), N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
N_("Declare memory regions as faulty (badram).")); N_("Declare memory regions as faulty (badram)."));
cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem, cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
N_("FROM[K|M|G] TO[K|M|G]"), N_("FROM[K|M|G] TO[K|M|G]"),
N_("Remove any memory regions in specified range.")); N_("Remove any memory regions in specified range."));
} }