0123-disk-lvm-Sanitize-rlocn-offset-to-prevent-wild-read.patch 1.3 KB

1234567891011121314151617181920212223242526272829303132333435363738394041
  1. From 701293684742d00133b39bf957d3642c81dc83f4 Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Fri, 22 Jan 2021 14:43:58 +1100
  4. Subject: [PATCH] disk/lvm: Sanitize rlocn->offset to prevent wild read
  5. rlocn->offset is read directly from disk and added to the metadatabuf
  6. pointer to create a pointer to a block of metadata. It's a 64-bit
  7. quantity so as long as you don't overflow you can set subsequent
  8. pointers to point anywhere in memory.
  9. Require that rlocn->offset fits within the metadata buffer size.
  10. Signed-off-by: Daniel Axtens <dja@axtens.net>
  11. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  12. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  13. ---
  14. grub-core/disk/lvm.c | 8 ++++++++
  15. 1 file changed, 8 insertions(+)
  16. diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
  17. index 742ecd6..ed0712f 100644
  18. --- a/grub-core/disk/lvm.c
  19. +++ b/grub-core/disk/lvm.c
  20. @@ -211,6 +211,14 @@ grub_lvm_detect (grub_disk_t disk,
  21. }
  22. rlocn = mdah->raw_locns;
  23. + if (grub_le_to_cpu64 (rlocn->offset) >= grub_le_to_cpu64 (mda_size))
  24. + {
  25. +#ifdef GRUB_UTIL
  26. + grub_util_info ("metadata offset is beyond end of metadata area");
  27. +#endif
  28. + goto fail2;
  29. + }
  30. +
  31. if (grub_le_to_cpu64 (rlocn->offset) + grub_le_to_cpu64 (rlocn->size) >
  32. grub_le_to_cpu64 (mdah->size))
  33. {
  34. --
  35. 2.14.2