2021-03-02 18:56:20 +00:00
|
|
|
|
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
|
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
|
|
Date: Wed, 14 Oct 2020 16:33:42 +0200
|
|
|
|
|
Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown
|
|
|
|
|
is enforced
|
|
|
|
|
|
|
|
|
|
The cutmem and badram commands can be used to remove EFI memory regions
|
|
|
|
|
and potentially disable the UEFI Secure Boot. Prevent the commands to be
|
|
|
|
|
registered if the GRUB is locked down.
|
|
|
|
|
|
|
|
|
|
Fixes: CVE-2020-27779
|
|
|
|
|
|
|
|
|
|
Reported-by: Teddy Reed <teddy.reed@gmail.com>
|
|
|
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
|
|
---
|
|
|
|
|
grub-core/mmap/mmap.c | 13 +++++++------
|
|
|
|
|
docs/grub.texi | 4 ++++
|
|
|
|
|
2 files changed, 11 insertions(+), 6 deletions(-)
|
|
|
|
|
|
|
|
|
|
diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
|
2022-05-10 07:20:45 +00:00
|
|
|
|
index 57b4e9a72..7ebf32e1e 100644
|
2021-03-02 18:56:20 +00:00
|
|
|
|
--- a/grub-core/mmap/mmap.c
|
|
|
|
|
+++ b/grub-core/mmap/mmap.c
|
|
|
|
|
@@ -20,6 +20,7 @@
|
|
|
|
|
#include <grub/memory.h>
|
|
|
|
|
#include <grub/machine/memory.h>
|
|
|
|
|
#include <grub/err.h>
|
|
|
|
|
+#include <grub/lockdown.h>
|
|
|
|
|
#include <grub/misc.h>
|
|
|
|
|
#include <grub/mm.h>
|
|
|
|
|
#include <grub/command.h>
|
|
|
|
|
@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
|
|
|
|
|
|
|
|
|
|
GRUB_MOD_INIT(mmap)
|
|
|
|
|
{
|
|
|
|
|
- cmd = grub_register_command ("badram", grub_cmd_badram,
|
|
|
|
|
- N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
|
|
|
|
- N_("Declare memory regions as faulty (badram)."));
|
|
|
|
|
- cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
|
|
|
|
|
- N_("FROM[K|M|G] TO[K|M|G]"),
|
|
|
|
|
- N_("Remove any memory regions in specified range."));
|
|
|
|
|
+ cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
|
|
|
|
|
+ N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
|
|
|
|
+ N_("Declare memory regions as faulty (badram)."));
|
|
|
|
|
+ cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
|
|
|
|
|
+ N_("FROM[K|M|G] TO[K|M|G]"),
|
|
|
|
|
+ N_("Remove any memory regions in specified range."));
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
diff --git a/docs/grub.texi b/docs/grub.texi
|
2022-05-10 07:20:45 +00:00
|
|
|
|
index 01acf672b..f1675b614 100644
|
2021-03-02 18:56:20 +00:00
|
|
|
|
--- a/docs/grub.texi
|
|
|
|
|
+++ b/docs/grub.texi
|
2021-05-18 06:38:48 +00:00
|
|
|
|
@@ -4103,6 +4103,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns
|
2021-03-02 18:56:20 +00:00
|
|
|
|
that are often result of memory damage, due to physical distribution of memory
|
|
|
|
|
cells.
|
|
|
|
|
|
|
|
|
|
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
|
|
|
|
|
+ This prevents removing EFI memory regions to potentially subvert the
|
|
|
|
|
+ security mechanisms provided by the UEFI secure boot.
|
|
|
|
|
+
|
|
|
|
|
@node blocklist
|
|
|
|
|
@subsection blocklist
|
|
|
|
|
|