Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-27 17:49:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs/bfs: Disable under lockdown

Browse Source 
The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown.
This will also disable the AFS.

Fixes: CVE-2024-45778
Fixes: CVE-2024-45779

Reported-by: Nils Langius <nils@langius.de>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens authored and Daniel Kiper committed 2025-02-13 15:45:56 +01:00
1 parent 5f31164aed
commit 26db660503
1 file changed
+5
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/fs/bfs.c
+5
View File
@@ -30,6 +30,7 @@
#include <grub/types.h> #include <grub/types.h>
#include <grub/i18n.h> #include <grub/i18n.h>
#include <grub/fshelp.h> #include <grub/fshelp.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+"); GRUB_MOD_LICENSE ("GPLv3+");
@@ -1106,9 +1107,12 @@ GRUB_MOD_INIT (bfs)
{ {
COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE ==
sizeof (struct grub_bfs_extent)); sizeof (struct grub_bfs_extent));
if (!grub_is_lockdown ())
{
grub_bfs_fs.mod = mod; grub_bfs_fs.mod = mod;
grub_fs_register (&grub_bfs_fs); grub_fs_register (&grub_bfs_fs);
} }
}
#ifdef MODE_AFS #ifdef MODE_AFS
GRUB_MOD_FINI (afs) GRUB_MOD_FINI (afs)
@@ -1116,5 +1120,6 @@ GRUB_MOD_FINI (afs)
GRUB_MOD_FINI (bfs) GRUB_MOD_FINI (bfs)
#endif #endif
{ {
if (!grub_is_lockdown ())
grub_fs_unregister (&grub_bfs_fs); grub_fs_unregister (&grub_bfs_fs);
} }