From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Daniel Axtens Date: Fri, 22 Jan 2021 14:43:58 +1100 Subject: [PATCH] disk/lvm: Sanitize rlocn->offset to prevent wild read rlocn->offset is read directly from disk and added to the metadatabuf pointer to create a pointer to a block of metadata. It's a 64-bit quantity so as long as you don't overflow you can set subsequent pointers to point anywhere in memory. Require that rlocn->offset fits within the metadata buffer size. Signed-off-by: Daniel Axtens Reviewed-by: Daniel Kiper --- grub-core/disk/lvm.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c index 267be7b95..9eda28d85 100644 --- a/grub-core/disk/lvm.c +++ b/grub-core/disk/lvm.c @@ -212,6 +212,14 @@ grub_lvm_detect (grub_disk_t disk, } rlocn = mdah->raw_locns; + if (grub_le_to_cpu64 (rlocn->offset) >= grub_le_to_cpu64 (mda_size)) + { +#ifdef GRUB_UTIL + grub_util_info ("metadata offset is beyond end of metadata area"); +#endif + goto fail2; + } + if (grub_le_to_cpu64 (rlocn->offset) + grub_le_to_cpu64 (rlocn->size) > grub_le_to_cpu64 (mdah->size)) {