Lncvrt/grub
1
0 Fork 0
mirror of https://git.savannah.gnu.org/git/grub.git synced 2026-10-21 06:49:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

mmap: Don't register cutmem and badram commands when lockdown is enforced

Browse Source 
The cutmem and badram commands can be used to remove EFI memory regions
and potentially disable the UEFI Secure Boot. Prevent the commands to be
registered if the GRUB is locked down.

Fixes: CVE-2020-27779

Reported-by: Teddy Reed <teddy.reed@gmail.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Javier Martinez Canillas authored and Daniel Kiper committed 2021-03-02 15:54:15 +01:00
1 parent 3e8e4c0549
commit d298b41f90
2 files changed
+11 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

grub-core/mmap/mmap.c
+7 -6
View File
@@ -20,6 +20,7 @@
#include <grub/memory.h>
#include <grub/machine/memory.h>
#include <grub/err.h>
#include <grub/lockdown.h>
#include <grub/misc.h>
#include <grub/mm.h>
#include <grub/command.h>
@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
GRUB_MOD_INIT(mmap)
{
cmd = grub_register_command ("badram", grub_cmd_badram,
N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
N_("Declare memory regions as faulty (badram)."));
cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
N_("FROM[K|M|G] TO[K|M|G]"),
N_("Remove any memory regions in specified range."));
cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
N_("Declare memory regions as faulty (badram)."));
cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
N_("FROM[K|M|G] TO[K|M|G]"),
N_("Remove any memory regions in specified range."));
}