Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-27 09:39:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

fs/bfs: Disable under lockdown

Browse Source 
The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown.
This will also disable the AFS.

Fixes: CVE-2024-45778
Fixes: CVE-2024-45779

Reported-by: Nils Langius <nils@langius.de>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens authored and Daniel Kiper committed 2025-02-13 15:45:56 +01:00
1 parent 5f31164aed
commit 26db660503
1 file changed
+8 -3
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/fs/bfs.c
+8 -3
View File
@@ -30,6 +30,7 @@
#include <grub/types.h> #include <grub/types.h>
#include <grub/i18n.h> #include <grub/i18n.h>
#include <grub/fshelp.h> #include <grub/fshelp.h>
#include <grub/lockdown.h>
GRUB_MOD_LICENSE ("GPLv3+"); GRUB_MOD_LICENSE ("GPLv3+");
@@ -1106,8 +1107,11 @@ GRUB_MOD_INIT (bfs)
{ {
COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE == COMPILE_TIME_ASSERT (1 << LOG_EXTENT_SIZE ==
sizeof (struct grub_bfs_extent)); sizeof (struct grub_bfs_extent));
grub_bfs_fs.mod = mod; if (!grub_is_lockdown ())
grub_fs_register (&grub_bfs_fs); {
grub_bfs_fs.mod = mod;
grub_fs_register (&grub_bfs_fs);
}
} }
#ifdef MODE_AFS #ifdef MODE_AFS
@@ -1116,5 +1120,6 @@ GRUB_MOD_FINI (afs)
GRUB_MOD_FINI (bfs) GRUB_MOD_FINI (bfs)
#endif #endif
{ {
grub_fs_unregister (&grub_bfs_fs); if (!grub_is_lockdown ())
grub_fs_unregister (&grub_bfs_fs);
} }