|
 |
b1bcb2 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b1bcb2 |
From: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
b1bcb2 |
Date: Wed, 14 Oct 2020 16:33:42 +0200
|
|
|
b1bcb2 |
Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown
|
|
|
b1bcb2 |
is enforced
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
The cutmem and badram commands can be used to remove EFI memory regions
|
|
|
b1bcb2 |
and potentially disable the UEFI Secure Boot. Prevent the commands to be
|
|
|
b1bcb2 |
registered if the GRUB is locked down.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Fixes: CVE-2020-27779
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
Reported-by: Teddy Reed <teddy.reed@gmail.com>
|
|
|
b1bcb2 |
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
|
|
|
b1bcb2 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b1bcb2 |
---
|
|
|
b1bcb2 |
grub-core/mmap/mmap.c | 13 +++++++------
|
|
|
b1bcb2 |
docs/grub.texi | 4 ++++
|
|
|
b1bcb2 |
2 files changed, 11 insertions(+), 6 deletions(-)
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
|
|
|
b1bcb2 |
index 57b4e9a72a9..7ebf32e1e5e 100644
|
|
|
b1bcb2 |
--- a/grub-core/mmap/mmap.c
|
|
|
b1bcb2 |
+++ b/grub-core/mmap/mmap.c
|
|
|
b1bcb2 |
@@ -20,6 +20,7 @@
|
|
|
b1bcb2 |
#include <grub/memory.h>
|
|
|
b1bcb2 |
#include <grub/machine/memory.h>
|
|
|
b1bcb2 |
#include <grub/err.h>
|
|
|
b1bcb2 |
+#include <grub/lockdown.h>
|
|
|
b1bcb2 |
#include <grub/misc.h>
|
|
|
b1bcb2 |
#include <grub/mm.h>
|
|
|
b1bcb2 |
#include <grub/command.h>
|
|
|
b1bcb2 |
@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
GRUB_MOD_INIT(mmap)
|
|
|
b1bcb2 |
{
|
|
|
b1bcb2 |
- cmd = grub_register_command ("badram", grub_cmd_badram,
|
|
|
b1bcb2 |
- N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
|
|
b1bcb2 |
- N_("Declare memory regions as faulty (badram)."));
|
|
|
b1bcb2 |
- cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
|
|
|
b1bcb2 |
- N_("FROM[K|M|G] TO[K|M|G]"),
|
|
|
b1bcb2 |
- N_("Remove any memory regions in specified range."));
|
|
|
b1bcb2 |
+ cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
|
|
|
b1bcb2 |
+ N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
|
|
|
b1bcb2 |
+ N_("Declare memory regions as faulty (badram)."));
|
|
|
b1bcb2 |
+ cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
|
|
|
b1bcb2 |
+ N_("FROM[K|M|G] TO[K|M|G]"),
|
|
|
b1bcb2 |
+ N_("Remove any memory regions in specified range."));
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
}
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
diff --git a/docs/grub.texi b/docs/grub.texi
|
|
|
b1bcb2 |
index 741f6c3fb51..5a1cfd4aea9 100644
|
|
|
b1bcb2 |
--- a/docs/grub.texi
|
|
|
b1bcb2 |
+++ b/docs/grub.texi
|
|
|
b1bcb2 |
@@ -3982,6 +3982,10 @@ this page is to be filtered. This syntax makes it easy to represent patterns
|
|
|
b1bcb2 |
that are often result of memory damage, due to physical distribution of memory
|
|
|
b1bcb2 |
cells.
|
|
|
b1bcb2 |
|
|
|
b1bcb2 |
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
|
|
|
b1bcb2 |
+ This prevents removing EFI memory regions to potentially subvert the
|
|
|
b1bcb2 |
+ security mechanisms provided by the UEFI secure boot.
|
|
|
b1bcb2 |
+
|
|
|
b1bcb2 |
@node blocklist
|
|
|
b1bcb2 |
@subsection blocklist
|
|
|
b1bcb2 |
|