58 lines
2.5 KiB
Diff
58 lines
2.5 KiB
Diff
|
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Alexey Makhalov <amakhalov@vmware.com>
|
||
|
|
Date: Mon, 20 Jul 2020 23:03:05 +0000
|
||
|
|
Subject: [PATCH] efi: Fix use-after-free in halt/reboot path
|
||
|
|
|
||
|
|
commit 92bfc33db984 ("efi: Free malloc regions on exit")
|
||
|
|
introduced memory freeing in grub_efi_fini(), which is
|
||
|
|
used not only by exit path but by halt/reboot one as well.
|
||
|
|
As result of memory freeing, code and data regions used by
|
||
|
|
modules, such as halt, reboot, acpi (used by halt) also got
|
||
|
|
freed. After return to module code, CPU executes, filled
|
||
|
|
by UEFI firmware (tested with edk2), 0xAFAFAFAF pattern as
|
||
|
|
a code. Which leads to #UD exception later.
|
||
|
|
|
||
|
|
grub> halt
|
||
|
|
!!!! X64 Exception Type - 06(#UD - Invalid Opcode) CPU Apic ID - 00000000 !!!!
|
||
|
|
RIP - 0000000003F4EC28, CS - 0000000000000038, RFLAGS - 0000000000200246
|
||
|
|
RAX - 0000000000000000, RCX - 00000000061DA188, RDX - 0A74C0854DC35D41
|
||
|
|
RBX - 0000000003E10E08, RSP - 0000000007F0F860, RBP - 0000000000000000
|
||
|
|
RSI - 00000000064DB768, RDI - 000000000832C5C3
|
||
|
|
R8 - 0000000000000002, R9 - 0000000000000000, R10 - 00000000061E2E52
|
||
|
|
R11 - 0000000000000020, R12 - 0000000003EE5C1F, R13 - 00000000061E0FF4
|
||
|
|
R14 - 0000000003E10D80, R15 - 00000000061E2F60
|
||
|
|
DS - 0000000000000030, ES - 0000000000000030, FS - 0000000000000030
|
||
|
|
GS - 0000000000000030, SS - 0000000000000030
|
||
|
|
CR0 - 0000000080010033, CR2 - 0000000000000000, CR3 - 0000000007C01000
|
||
|
|
CR4 - 0000000000000668, CR8 - 0000000000000000
|
||
|
|
DR0 - 0000000000000000, DR1 - 0000000000000000, DR2 - 0000000000000000
|
||
|
|
DR3 - 0000000000000000, DR6 - 00000000FFFF0FF0, DR7 - 0000000000000400
|
||
|
|
GDTR - 00000000079EEA98 0000000000000047, LDTR - 0000000000000000
|
||
|
|
IDTR - 0000000007598018 0000000000000FFF, TR - 0000000000000000
|
||
|
|
FXSAVE_STATE - 0000000007F0F4C0
|
||
|
|
|
||
|
|
Proposal here is to continue to free allocated memory for
|
||
|
|
exit boot services path but keep it for halt/reboot path
|
||
|
|
as it won't be much security concern here.
|
||
|
|
Introduced GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY
|
||
|
|
loader flag to be used by efi halt/reboot path.
|
||
|
|
|
||
|
|
Signed-off-by: Alexey Makhalov <amakhalov@vmware.com>
|
||
|
|
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
|
||
|
|
---
|
||
|
|
grub-core/kern/riscv/efi/init.c | 3 +++
|
||
|
|
1 file changed, 3 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/grub-core/kern/riscv/efi/init.c b/grub-core/kern/riscv/efi/init.c
|
||
|
|
index 7eb1969d0b0..38795fe6741 100644
|
||
|
|
--- a/grub-core/kern/riscv/efi/init.c
|
||
|
|
+++ b/grub-core/kern/riscv/efi/init.c
|
||
|
|
@@ -73,4 +73,7 @@ grub_machine_fini (int flags)
|
||
|
|
return;
|
||
|
|
|
||
|
|
grub_efi_fini ();
|
||
|
|
+
|
||
|
|
+ if (!(flags & GRUB_LOADER_FLAG_EFI_KEEP_ALLOCATED_MEMORY))
|
||
|
|
+ grub_efi_memory_fini ();
|
||
|
|
}
|