Chris Coulson 4ea7bae51f kern/parser: Fix a stack buffer overflow ...

grub_parser_split_cmdline() expands variable names present in the supplied
command line in to their corresponding variable contents and uses a 1 kiB
stack buffer for temporary storage without sufficient bounds checking. If
the function is called with a command line that references a variable with
a sufficiently large payload, it is possible to overflow the stack
buffer via tab completion, corrupt the stack frame and potentially
control execution.

Fixes: CVE-2020-27749

Reported-by: Chris Coulson <chris.coulson@canonical.com>
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

2021-03-02 15:54:19 +01:00

..

boot

A workaround for clang problem assembling startup_raw.S

2019-04-08 15:22:10 +10:00

bus

usb: Avoid possible out-of-bound accesses caused by malicious devices

2021-03-02 15:54:15 +01:00

commands

commands/menuentry: Fix quoting in setparams_prefix()

2021-03-02 15:54:17 +01:00

disk

disk/lvm: Do not allow a LV to be it's own segment's node's LV

2021-03-02 15:54:19 +01:00

efiemu

calloc: Use calloc() at most places

2020-07-29 16:55:47 +02:00

font

font: Do not load more than one NAME section

2020-07-29 16:55:48 +02:00

fs

fs/btrfs: Squash some uninitialized reads

2021-03-02 15:54:19 +01:00

gdb

gdb: Restrict GDB access when locked down

2021-03-02 15:54:15 +01:00

gettext

verifiers: File type for fine-grained signature-verification controlling

2018-11-09 13:25:31 +01:00

gfxmenu

gfxmenu/gui_list: Remove code that coverity is flagging as dead

2021-03-02 15:54:17 +01:00

hello

* grub-core/commands/gptsync.c: Fix typographic quoting.

2012-03-03 13:05:08 +01:00

hook

* grub-core/hook/datehook.c (grub_read_hook_datetime): Small stylistic

2011-11-11 21:03:49 +01:00

io

io/gzio: Zero gzio->tl/td in init_dynamic_block() if huft_build() fails

2021-03-02 15:54:18 +01:00

kern

kern/parser: Fix a stack buffer overflow

2021-03-02 15:54:19 +01:00

lib

lib/arg: Block repeated short options that require an argument

2021-03-02 15:54:17 +01:00

loader

loader/xnu: Check if pointer is NULL before using it

2021-03-02 15:54:17 +01:00

mmap

mmap: Fix memory leak when iterating over mapped memory

2021-03-02 15:54:15 +01:00

net

net/tftp: Fix dangling memory pointer

2021-03-02 15:54:16 +01:00

normal

normal/completion: Fix leaking of memory when processing a completion

2021-03-02 15:54:17 +01:00

osdep

disk: Rename grub_disk_get_size() to grub_disk_native_sectors()

2020-12-12 01:19:03 +01:00

partmap

mbr: Warn if MBR gap is small and user uses advanced modules

2020-12-12 01:19:03 +01:00

parttool

* grub-core/net/http.c: Add TRANSLATORS comments.

2012-03-05 16:42:26 +01:00

script

script/execute: Don't crash on a "for" loop with no items

2021-03-02 15:54:17 +01:00

term

term/gfxterm: Don't set up a font with glyphs that are too big

2021-03-02 15:54:18 +01:00

tests

calloc: Use calloc() at most places

2020-07-29 16:55:47 +02:00

video

video/readers/jpeg: Don't decode data before start of stream

2021-03-02 15:54:18 +01:00

gdb_grub.in

* grub-core/gdb_grub.in: Fix overflow and wrong field.

2013-10-14 03:40:20 +02:00

genemuinit.sh

use MODULE_FILES for genemuinit* instead of MOD_FILES

2014-01-18 23:15:40 +04:00

genemuinitheader.sh

use MODULE_FILES for genemuinit* instead of MOD_FILES

2014-01-18 23:15:40 +04:00

genmod.sh.in

.mod files: Strip annobin annotations and .eh_frame, and their relocations

2018-03-05 14:08:22 +01:00

genmoddep.awk

enforcing fixup

2017-08-14 16:27:10 +02:00

gensyminfo.sh.in

Fix shebang for termux.

2017-05-03 12:49:31 +02:00

gensymlist.sh

Make 'make check' work on emu.

2013-04-27 02:00:16 +02:00

gentrigtables.c

* grub-core/gentrigtables.c: Make tables const.

2013-03-01 11:15:09 +01:00

gmodule.pl.in

* grub-core/gmodule.pl.in: Accept newer binutils which output

2014-09-21 18:23:23 +02:00

Makefile.am

kern: Add lockdown support

2021-03-02 15:54:15 +01:00

Makefile.core.def

kern/buffer: Add variable sized heap buffer

2021-03-02 15:54:19 +01:00

modinfo.sh.in

Fix shebang for termux.

2017-05-03 12:49:31 +02:00