0039-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch 2.8 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576
  1. From 3e8e4c0549240fa209acffceb473e1e509b50c95 Mon Sep 17 00:00:00 2001
  2. From: Javier Martinez Canillas <javierm@redhat.com>
  3. Date: Mon, 28 Sep 2020 20:08:41 +0200
  4. Subject: [PATCH] acpi: Don't register the acpi command when locked down
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. The command is not allowed when lockdown is enforced. Otherwise an
  9. attacker can instruct the GRUB to load an SSDT table to overwrite
  10. the kernel lockdown configuration and later load and execute
  11. unsigned code.
  12. Fixes: CVE-2020-14372
  13. Reported-by: Máté Kukri <km@mkukri.xyz>
  14. Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
  15. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  16. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  17. ---
  18. docs/grub.texi | 5 +++++
  19. grub-core/commands/acpi.c | 15 ++++++++-------
  20. 2 files changed, 13 insertions(+), 7 deletions(-)
  21. diff --git a/docs/grub.texi b/docs/grub.texi
  22. index bbe60a4..98592d3 100644
  23. --- a/docs/grub.texi
  24. +++ b/docs/grub.texi
  25. @@ -3986,6 +3986,11 @@ Normally, this command will replace the Root System Description Pointer
  26. (RSDP) in the Extended BIOS Data Area to point to the new tables. If the
  27. @option{--no-ebda} option is used, the new tables will be known only to
  28. GRUB, but may be used by GRUB's EFI emulation.
  29. +
  30. +Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
  31. + Otherwise an attacker can instruct the GRUB to load an SSDT table to
  32. + overwrite the kernel lockdown configuration and later load and execute
  33. + unsigned code.
  34. @end deffn
  35. diff --git a/grub-core/commands/acpi.c b/grub-core/commands/acpi.c
  36. index 5a1499a..1215f2a 100644
  37. --- a/grub-core/commands/acpi.c
  38. +++ b/grub-core/commands/acpi.c
  39. @@ -27,6 +27,7 @@
  40. #include <grub/mm.h>
  41. #include <grub/memory.h>
  42. #include <grub/i18n.h>
  43. +#include <grub/lockdown.h>
  44. #ifdef GRUB_MACHINE_EFI
  45. #include <grub/efi/efi.h>
  46. @@ -775,13 +776,13 @@ static grub_extcmd_t cmd;
  47. GRUB_MOD_INIT(acpi)
  48. {
  49. - cmd = grub_register_extcmd ("acpi", grub_cmd_acpi, 0,
  50. - N_("[-1|-2] [--exclude=TABLE1,TABLE2|"
  51. - "--load-only=TABLE1,TABLE2] FILE1"
  52. - " [FILE2] [...]"),
  53. - N_("Load host ACPI tables and tables "
  54. - "specified by arguments."),
  55. - options);
  56. + cmd = grub_register_extcmd_lockdown ("acpi", grub_cmd_acpi, 0,
  57. + N_("[-1|-2] [--exclude=TABLE1,TABLE2|"
  58. + "--load-only=TABLE1,TABLE2] FILE1"
  59. + " [FILE2] [...]"),
  60. + N_("Load host ACPI tables and tables "
  61. + "specified by arguments."),
  62. + options);
  63. }
  64. GRUB_MOD_FINI(acpi)
  65. --
  66. 2.14.2