0040-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch 2.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970
  1. From d298b41f90cbf1f2e5a10e29daa1fc92ddee52c9 Mon Sep 17 00:00:00 2001
  2. From: Javier Martinez Canillas <javierm@redhat.com>
  3. Date: Wed, 14 Oct 2020 16:33:42 +0200
  4. Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown
  5. is enforced
  6. The cutmem and badram commands can be used to remove EFI memory regions
  7. and potentially disable the UEFI Secure Boot. Prevent the commands to be
  8. registered if the GRUB is locked down.
  9. Fixes: CVE-2020-27779
  10. Reported-by: Teddy Reed <teddy.reed@gmail.com>
  11. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
  12. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  13. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  14. ---
  15. docs/grub.texi | 4 ++++
  16. grub-core/mmap/mmap.c | 13 +++++++------
  17. 2 files changed, 11 insertions(+), 6 deletions(-)
  18. diff --git a/docs/grub.texi b/docs/grub.texi
  19. index 98592d3..f2fe149 100644
  20. --- a/docs/grub.texi
  21. +++ b/docs/grub.texi
  22. @@ -4051,6 +4051,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns
  23. that are often result of memory damage, due to physical distribution of memory
  24. cells.
  25. +Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
  26. + This prevents removing EFI memory regions to potentially subvert the
  27. + security mechanisms provided by the UEFI secure boot.
  28. +
  29. @node blocklist
  30. @subsection blocklist
  31. diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
  32. index 57b4e9a..7ebf32e 100644
  33. --- a/grub-core/mmap/mmap.c
  34. +++ b/grub-core/mmap/mmap.c
  35. @@ -20,6 +20,7 @@
  36. #include <grub/memory.h>
  37. #include <grub/machine/memory.h>
  38. #include <grub/err.h>
  39. +#include <grub/lockdown.h>
  40. #include <grub/misc.h>
  41. #include <grub/mm.h>
  42. #include <grub/command.h>
  43. @@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
  44. GRUB_MOD_INIT(mmap)
  45. {
  46. - cmd = grub_register_command ("badram", grub_cmd_badram,
  47. - N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
  48. - N_("Declare memory regions as faulty (badram)."));
  49. - cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
  50. - N_("FROM[K|M|G] TO[K|M|G]"),
  51. - N_("Remove any memory regions in specified range."));
  52. + cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
  53. + N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
  54. + N_("Declare memory regions as faulty (badram)."));
  55. + cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
  56. + N_("FROM[K|M|G] TO[K|M|G]"),
  57. + N_("Remove any memory regions in specified range."));
  58. }
  59. --
  60. 2.14.2