From 343aee243d65b8b2944d6bb8198c9b20ada6877c Mon Sep 17 00:00:00 2001 From: Therese Cornell Date: Thu, 19 Feb 2026 08:46:34 -0500 Subject: [PATCH] Fix CVE-2025-61662 Missing unregister call for gettext command may lead to use-after-free Resolves: RHEL-141583 --- ...Unregister-gettext-command-on-module.patch | 62 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 6 +- 3 files changed, 68 insertions(+), 1 deletion(-) create mode 100644 0683-gettext-gettext-Unregister-gettext-command-on-module.patch diff --git a/0683-gettext-gettext-Unregister-gettext-command-on-module.patch b/0683-gettext-gettext-Unregister-gettext-command-on-module.patch new file mode 100644 index 0000000..89741a1 --- /dev/null +++ b/0683-gettext-gettext-Unregister-gettext-command-on-module.patch @@ -0,0 +1,62 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alec Brown +Date: Thu, 21 Aug 2025 21:14:06 +0000 +Subject: [PATCH] gettext/gettext: Unregister gettext command on module unload + +When the gettext module is loaded, the gettext command is registered but +isn't unregistered when the module is unloaded. We need to add a call to +grub_unregister_command() when unloading the module. + +Fixes: CVE-2025-61662 + +Reported-by: Alec Brown +Signed-off-by: Alec Brown +Reviewed-by: Daniel Kiper +--- + grub-core/gettext/gettext.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c +index 0e51b5d28ad0..92e91b35e87f 100644 +--- a/grub-core/gettext/gettext.c ++++ b/grub-core/gettext/gettext.c +@@ -509,6 +509,8 @@ grub_cmd_translate (grub_command_t cmd __attribute__ ((unused)), + return 0; + } + ++static grub_command_t cmd; ++ + GRUB_MOD_INIT (gettext) + { + const char *lang; +@@ -528,13 +530,14 @@ GRUB_MOD_INIT (gettext) + grub_register_variable_hook ("locale_dir", NULL, read_main); + grub_register_variable_hook ("secondary_locale_dir", NULL, read_secondary); + +- grub_register_command_p1 ("gettext", grub_cmd_translate, +- N_("STRING"), +- /* TRANSLATORS: It refers to passing the string through gettext. +- So it's "translate" in the same meaning as in what you're +- doing now. +- */ +- N_("Translates the string with the current settings.")); ++ cmd = grub_register_command_p1 ("gettext", grub_cmd_translate, ++ N_("STRING"), ++ /* ++ * TRANSLATORS: It refers to passing the string through gettext. ++ * So it's "translate" in the same meaning as in what you're ++ * doing now. ++ */ ++ N_("Translates the string with the current settings.")); + + /* Reload .mo file information if lang changes. */ + grub_register_variable_hook ("lang", NULL, grub_gettext_env_write_lang); +@@ -551,6 +554,8 @@ GRUB_MOD_FINI (gettext) + grub_register_variable_hook ("secondary_locale_dir", NULL, NULL); + grub_register_variable_hook ("lang", NULL, NULL); + ++ grub_unregister_command (cmd); ++ + grub_gettext_delete_list (&main_context); + grub_gettext_delete_list (&secondary_context); + diff --git a/grub.patches b/grub.patches index 16ba72c..003d7b2 100644 --- a/grub.patches +++ b/grub.patches @@ -679,3 +679,4 @@ Patch0679: 0679-disk-Rename-grub_disk_get_size-to-grub_disk_native_s.patch Patch0680: 0680-fs-Fix-block-lists-not-being-able-to-address-to-end-.patch Patch0681: 0681-osdep-linux-hostdisk-Modify-sector-by-sysfs-as-disk-.patch Patch0682: 0682-cryptodisk-Fix-incorrect-calculation-of-start-sector.patch +Patch0683: 0683-gettext-gettext-Unregister-gettext-command-on-module.patch diff --git a/grub2.spec b/grub2.spec index 6e227c5..1ed0141 100644 --- a/grub2.spec +++ b/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 1 Version: 2.02 -Release: 170%{?dist} +Release: 170%{?dist}.1 Summary: Bootloader with support for Linux, Multiboot and more Group: System Environment/Base License: GPLv3+ @@ -526,6 +526,10 @@ fi %endif %changelog +* Thu Feb 19 2026 Therese Cornell - 2.02-170.1 +- Fixes CVE-2025-61662 Missing unregister call for gettext command may lead to use-after-free +- Resolves: #RHEL-141583 + * Thu Jan 22 2026 Nicolas Frayer - 2.02-170 - fs/xfs/ppc64le: Update xfs code to fix install on 4KB block size - Resolves: #RHEL-142208