12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576 |
- From 3e8e4c0549240fa209acffceb473e1e509b50c95 Mon Sep 17 00:00:00 2001
- From: Javier Martinez Canillas <javierm@redhat.com>
- Date: Mon, 28 Sep 2020 20:08:41 +0200
- Subject: [PATCH] acpi: Don't register the acpi command when locked down
- MIME-Version: 1.0
- Content-Type: text/plain; charset=UTF-8
- Content-Transfer-Encoding: 8bit
- The command is not allowed when lockdown is enforced. Otherwise an
- attacker can instruct the GRUB to load an SSDT table to overwrite
- the kernel lockdown configuration and later load and execute
- unsigned code.
- Fixes: CVE-2020-14372
- Reported-by: Máté Kukri <km@mkukri.xyz>
- Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
- Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
- Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
- ---
- docs/grub.texi | 5 +++++
- grub-core/commands/acpi.c | 15 ++++++++-------
- 2 files changed, 13 insertions(+), 7 deletions(-)
- diff --git a/docs/grub.texi b/docs/grub.texi
- index bbe60a4..98592d3 100644
- --- a/docs/grub.texi
- +++ b/docs/grub.texi
- @@ -3986,6 +3986,11 @@ Normally, this command will replace the Root System Description Pointer
- (RSDP) in the Extended BIOS Data Area to point to the new tables. If the
- @option{--no-ebda} option is used, the new tables will be known only to
- GRUB, but may be used by GRUB's EFI emulation.
- +
- +Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
- + Otherwise an attacker can instruct the GRUB to load an SSDT table to
- + overwrite the kernel lockdown configuration and later load and execute
- + unsigned code.
- @end deffn
-
-
- diff --git a/grub-core/commands/acpi.c b/grub-core/commands/acpi.c
- index 5a1499a..1215f2a 100644
- --- a/grub-core/commands/acpi.c
- +++ b/grub-core/commands/acpi.c
- @@ -27,6 +27,7 @@
- #include <grub/mm.h>
- #include <grub/memory.h>
- #include <grub/i18n.h>
- +#include <grub/lockdown.h>
-
- #ifdef GRUB_MACHINE_EFI
- #include <grub/efi/efi.h>
- @@ -775,13 +776,13 @@ static grub_extcmd_t cmd;
-
- GRUB_MOD_INIT(acpi)
- {
- - cmd = grub_register_extcmd ("acpi", grub_cmd_acpi, 0,
- - N_("[-1|-2] [--exclude=TABLE1,TABLE2|"
- - "--load-only=TABLE1,TABLE2] FILE1"
- - " [FILE2] [...]"),
- - N_("Load host ACPI tables and tables "
- - "specified by arguments."),
- - options);
- + cmd = grub_register_extcmd_lockdown ("acpi", grub_cmd_acpi, 0,
- + N_("[-1|-2] [--exclude=TABLE1,TABLE2|"
- + "--load-only=TABLE1,TABLE2] FILE1"
- + " [FILE2] [...]"),
- + N_("Load host ACPI tables and tables "
- + "specified by arguments."),
- + options);
- }
-
- GRUB_MOD_FINI(acpi)
- --
- 2.14.2
|