67 lines
2.5 KiB
Diff
67 lines
2.5 KiB
Diff
|
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|||
|
|
From: Javier Martinez Canillas <javierm@redhat.com>
|
|||
|
|
Date: Wed, 14 Oct 2020 16:33:42 +0200
|
|||
|
|
Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown
|
|||
|
|
is enforced
|
|||
|
|
|
|||
|
|
The cutmem and badram commands can be used to remove EFI memory regions
|
|||
|
|
and potentially disable the UEFI Secure Boot. Prevent the commands to be
|
|||
|
|
registered if the GRUB is locked down.
|
|||
|
|
|
|||
|
|
Fixes: CVE-2020-27779
|
|||
|
|
|
|||
|
|
Reported-by: Teddy Reed <teddy.reed@gmail.com>
|
|||
|
|
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|||
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|||
|
|
---
|
|||
|
|
grub-core/mmap/mmap.c | 13 +++++++------
|
|||
|
|
docs/grub.texi | 4 ++++
|
|||
|
|
2 files changed, 11 insertions(+), 6 deletions(-)
|
|||
|
|
|
|||
|
|
diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
|
|||
|
|
index 57b4e9a72a9..7ebf32e1e5e 100644
|
|||
|
|
--- a/grub-core/mmap/mmap.c
|
|||
|
|
+++ b/grub-core/mmap/mmap.c
|
|||
|
|
@@ -20,6 +20,7 @@
|
|||
|
|
#include <grub/memory.h>
|
|||
|
|
#include <grub/machine/memory.h>
|
|||
|
|
#include <grub/err.h>
|
|||
|
|
+#include <grub/lockdown.h>
|
|||
|
|
#include <grub/misc.h>
|
|||
|
|
#include <grub/mm.h>
|
|||
|
|
#include <grub/command.h>
|
|||
|
|
@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
|
|||
|
|
|
|||
|
|
GRUB_MOD_INIT(mmap)
|
|||
|
|
{
|
|||
|
|
- cmd = grub_register_command ("badram", grub_cmd_badram,
|
|||
|
|
- N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
|||
|
|
- N_("Declare memory regions as faulty (badram)."));
|
|||
|
|
- cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
|
|||
|
|
- N_("FROM[K|M|G] TO[K|M|G]"),
|
|||
|
|
- N_("Remove any memory regions in specified range."));
|
|||
|
|
+ cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
|
|||
|
|
+ N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
|||
|
|
+ N_("Declare memory regions as faulty (badram)."));
|
|||
|
|
+ cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
|
|||
|
|
+ N_("FROM[K|M|G] TO[K|M|G]"),
|
|||
|
|
+ N_("Remove any memory regions in specified range."));
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
diff --git a/docs/grub.texi b/docs/grub.texi
|
|||
|
|
index 01acf672b80..f1675b6140c 100644
|
|||
|
|
--- a/docs/grub.texi
|
|||
|
|
+++ b/docs/grub.texi
|
|||
|
|
@@ -4103,6 +4103,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns
|
|||
|
|
that are often result of memory damage, due to physical distribution of memory
|
|||
|
|
cells.
|
|||
|
|
|
|||
|
|
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
|
|||
|
|
+ This prevents removing EFI memory regions to potentially subvert the
|
|||
|
|
+ security mechanisms provided by the UEFI secure boot.
|
|||
|
|
+
|
|||
|
|
@node blocklist
|
|||
|
|
@subsection blocklist
|
|||
|
|
|