38 lines
1.2 KiB
Diff
38 lines
1.2 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Axtens <dja@axtens.net>
|
|
Date: Fri, 22 Jan 2021 14:43:58 +1100
|
|
Subject: [PATCH] disk/lvm: Sanitize rlocn->offset to prevent wild read
|
|
|
|
rlocn->offset is read directly from disk and added to the metadatabuf
|
|
pointer to create a pointer to a block of metadata. It's a 64-bit
|
|
quantity so as long as you don't overflow you can set subsequent
|
|
pointers to point anywhere in memory.
|
|
|
|
Require that rlocn->offset fits within the metadata buffer size.
|
|
|
|
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
---
|
|
grub-core/disk/lvm.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
|
|
index 267be7b9536..9eda28d852c 100644
|
|
--- a/grub-core/disk/lvm.c
|
|
+++ b/grub-core/disk/lvm.c
|
|
@@ -212,6 +212,14 @@ grub_lvm_detect (grub_disk_t disk,
|
|
}
|
|
|
|
rlocn = mdah->raw_locns;
|
|
+ if (grub_le_to_cpu64 (rlocn->offset) >= grub_le_to_cpu64 (mda_size))
|
|
+ {
|
|
+#ifdef GRUB_UTIL
|
|
+ grub_util_info ("metadata offset is beyond end of metadata area");
|
|
+#endif
|
|
+ goto fail2;
|
|
+ }
|
|
+
|
|
if (grub_le_to_cpu64 (rlocn->offset) + grub_le_to_cpu64 (rlocn->size) >
|
|
grub_le_to_cpu64 (mdah->size))
|
|
{
|