6eaa34fe07
- Resolves: CVE-2024-45779 CVE-2024-45778 CVE-2025-1118 - Resolves: CVE-2025-0677 CVE-2024-45782 CVE-2025-0690 - Resolves: CVE-2024-45783 CVE-2025-0624 CVE-2024-45776 - Resolves: CVE-2025-0622 CVE-2024-45774 CVE-2024-45775 - Resolves: CVE-2024-45781 CVE-2024-45780 - Resolves: #RHEL-79700 - Resolves: #RHEL-79341 - Resolves: #RHEL-79875 - Resolves: #RHEL-79849 - Resolves: #RHEL-79707 - Resolves: #RHEL-79857 - Resolves: #RHEL-79709 - Resolves: #RHEL-79846 - Resolves: #RHEL-75737 - Resolves: #RHEL-79713 - Resolves: #RHEL-73785 - Resolves: #RHEL-73787 - Resolves: #RHEL-79704 - Resolves: #RHEL-79702 Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
56 lines
1.9 KiB
Diff
56 lines
1.9 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: B Horn <b@horn.uk>
|
|
Date: Thu, 18 Apr 2024 19:04:13 +0100
|
|
Subject: [PATCH] script/execute: Limit the recursion depth
|
|
|
|
If unbounded recursion is allowed it becomes possible to collide the
|
|
stack with the heap. As UEFI firmware often lacks guard pages this
|
|
becomes an exploitable issue as it is possible in some cases to do
|
|
a controlled overwrite of a section of this heap region with
|
|
arbitrary data.
|
|
|
|
Reported-by: B Horn <b@horn.uk>
|
|
Signed-off-by: B Horn <b@horn.uk>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
---
|
|
grub-core/script/execute.c | 14 ++++++++++++++
|
|
1 file changed, 14 insertions(+)
|
|
|
|
diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
|
|
index 0c6dd9c52..c383eb87c 100644
|
|
--- a/grub-core/script/execute.c
|
|
+++ b/grub-core/script/execute.c
|
|
@@ -36,10 +36,18 @@
|
|
is sizeof (int) * 3, and one extra for a possible -ve sign. */
|
|
#define ERRNO_DIGITS_MAX (sizeof (int) * 3 + 1)
|
|
|
|
+/*
|
|
+ * A limit on recursion, to avoid colliding with the heap. UEFI defines a baseline
|
|
+ * stack size of 128 KiB. So, assuming at most 1-2 KiB per iteration this should
|
|
+ * keep us safe.
|
|
+ */
|
|
+#define MAX_RECURSION_DEPTH 64
|
|
+
|
|
static unsigned long is_continue;
|
|
static unsigned long active_loops;
|
|
static unsigned long active_breaks;
|
|
static unsigned long function_return;
|
|
+static unsigned long recursion_depth;
|
|
|
|
#define GRUB_SCRIPT_SCOPE_MALLOCED 1
|
|
#define GRUB_SCRIPT_SCOPE_ARGS_MALLOCED 2
|
|
@@ -850,7 +858,13 @@ grub_script_execute_cmd (struct grub_script_cmd *cmd)
|
|
if (cmd == 0)
|
|
return 0;
|
|
|
|
+ recursion_depth++;
|
|
+
|
|
+ if (recursion_depth >= MAX_RECURSION_DEPTH)
|
|
+ return grub_error (GRUB_ERR_RECURSION_DEPTH, N_("maximum recursion depth exceeded"));
|
|
+
|
|
ret = cmd->exec (cmd);
|
|
+ recursion_depth--;
|
|
|
|
grub_snprintf (errnobuf, sizeof (errnobuf), "%d", ret);
|
|
grub_env_set ("?", errnobuf);
|