Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-22 23:32:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

net/bootp: Prevent a UAF in network interface unregister

Browse Source 
A UAF occurs in grub_net_network_level_interface_unregister()
when inter->name is accessed after being freed in grub_cmd_bootp().
Fix it by deferring grub_free(ifaces[j].name) until after
grub_net_network_level_interface_unregister() completes.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Lidong Chen authored and Daniel Kiper committed 2025-10-24 20:05:07 +02:00
1 parent fca6c0afda
commit cd24e25910
1 file changed
+5 -2
Download Patch File Download Diff File Expand all files Collapse all files
grub-core/net/bootp.c
+5 -2
View File
@@ -901,14 +901,17 @@ grub_cmd_bootp (struct grub_command *cmd __attribute__ ((unused)),
err = GRUB_ERR_NONE; err = GRUB_ERR_NONE;
for (j = 0; j < ncards; j++) for (j = 0; j < ncards; j++)
{ {
grub_free (ifaces[j].name);
if (!ifaces[j].prev) if (!ifaces[j].prev)
continue; {
grub_free (ifaces[j].name);
continue;
}
grub_error_push (); grub_error_push ();
grub_net_network_level_interface_unregister (&ifaces[j]); grub_net_network_level_interface_unregister (&ifaces[j]);
err = grub_error (GRUB_ERR_FILE_NOT_FOUND, err = grub_error (GRUB_ERR_FILE_NOT_FOUND,
N_("couldn't autoconfigure %s"), N_("couldn't autoconfigure %s"),
ifaces[j].card->name); ifaces[j].card->name);
grub_free (ifaces[j].name);
} }
grub_free (ifaces); grub_free (ifaces);