From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: B Horn Date: Tue, 11 Feb 2025 16:38:44 -0600 Subject: [PATCH] net: Fix OOB write in grub_net_search_config_file() The function included a call to grub_strcpy() which copied data from an environment variable to a buffer allocated in grub_cmd_normal(). The grub_cmd_normal() didn't consider the length of the environment variable. So, the copy operation could exceed the allocation and lead to an OOB write. Fix the issue by replacing grub_strcpy() with grub_strlcpy() and pass the underlying buffers size to the grub_net_search_config_file(). Fixes: CVE-2025-0624 Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/net/net.c | 7 ++++--- grub-core/normal/main.c | 2 +- include/grub/net.h | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/grub-core/net/net.c b/grub-core/net/net.c index 22d5cc3ba..6c8dfcba2 100644 --- a/grub-core/net/net.c +++ b/grub-core/net/net.c @@ -2023,14 +2023,15 @@ grub_config_search_through (char *config, char *suffix, } grub_err_t -grub_net_search_config_file (char *config) +grub_net_search_config_file (char *config, grub_size_t config_buf_len) { - grub_size_t config_len; + grub_size_t config_len, suffix_len; char *suffix; config_len = grub_strlen (config); config[config_len] = '-'; suffix = config + config_len + 1; + suffix_len = config_buf_len - (config_len + 1); struct grub_net_network_level_interface *inf; FOR_NET_NETWORK_LEVEL_INTERFACES (inf) @@ -2056,7 +2057,7 @@ grub_net_search_config_file (char *config) if (client_uuid) { - grub_strcpy (suffix, client_uuid); + grub_strlcpy (suffix, client_uuid, suffix_len); if (grub_config_search_through (config, suffix, 1, 0) == 0) return GRUB_ERR_NONE; } diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c index 86ffb388d..cad840e06 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c @@ -360,7 +360,7 @@ grub_try_normal_prefix (const char *prefix) return err; grub_snprintf (config, config_len, "%s/grub.cfg", prefix); - err = grub_net_search_config_file (config); + err = grub_net_search_config_file (config, config_len); } if (err != GRUB_ERR_NONE) diff --git a/include/grub/net.h b/include/grub/net.h index 273afbddf..d280acd72 100644 --- a/include/grub/net.h +++ b/include/grub/net.h @@ -655,7 +655,7 @@ void grub_net_remove_dns_server (const struct grub_net_network_level_address *s); grub_err_t -grub_net_search_config_file (char *config); +grub_net_search_config_file (char *config, grub_size_t config_buf_len); extern char *grub_net_default_server;