File 0011-mmap-Don-t-register-cutmem-and-badram-comm... of Package grub2

Overview Repositories Revisions Requests Users Attributes Meta

File 0011-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch of Package grub2 (Revision bbf601693c89d7de44833538539dce54)

Currently displaying revision bbf601693c89d7de44833538539dce54 , Show latest

From 7fb468b0bdb383b1b9f21465e14c3e74c1d3cc00 Mon Sep 17 00:00:00 2001
From: Javier Martinez Canillas <javierm@redhat.com>
Date: Wed, 14 Oct 2020 16:33:42 +0200
Subject: [PATCH 11/41] mmap: Don't register cutmem and badram commands when
 lockdown is enforced

The cutmem and badram commands can be used to remove EFI memory regions
and potentially disable the UEFI Secure Boot. Prevent the commands to be
registered if the GRUB is locked down.

Fixes: CVE-2020-27779

Reported-by: Teddy Reed <teddy.reed@gmail.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 docs/grub.texi        |  4 ++++
 grub-core/mmap/mmap.c | 13 +++++++------
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/docs/grub.texi b/docs/grub.texi
index 6c67d55de..8089f3925 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -3972,6 +3972,10 @@ this page is to be filtered.  This syntax makes it easy to represent patterns
 that are often result of memory damage, due to physical distribution of memory
 cells.
 
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
+      This prevents removing EFI memory regions to potentially subvert the
+      security mechanisms provided by the UEFI secure boot.
+
 @node blocklist
 @subsection blocklist
 
diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
index 57b4e9a72..7ebf32e1e 100644
--- a/grub-core/mmap/mmap.c
+++ b/grub-core/mmap/mmap.c
@@ -20,6 +20,7 @@
 #include <grub/memory.h>
 #include <grub/machine/memory.h>
 #include <grub/err.h>
+#include <grub/lockdown.h>
 #include <grub/misc.h>
 #include <grub/mm.h>
 #include <grub/command.h>
@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
 
 GRUB_MOD_INIT(mmap)
 {
-  cmd = grub_register_command ("badram", grub_cmd_badram,
-			       N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
-			       N_("Declare memory regions as faulty (badram)."));
-  cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
-				   N_("FROM[K|M|G] TO[K|M|G]"),
-				   N_("Remove any memory regions in specified range."));
+  cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
+                                        N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
+                                        N_("Declare memory regions as faulty (badram)."));
+  cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
+                                            N_("FROM[K|M|G] TO[K|M|G]"),
+                                            N_("Remove any memory regions in specified range."));
 
 }
 
-- 
2.26.2

Places

File 0011-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch of Package grub2 (Revision bbf601693c89d7de44833538539dce54)

Places