dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0427-kern-parser-Fix-a-stack-buffer-overflow.patch

b1bcb2
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b1bcb2
From: Chris Coulson <chris.coulson@canonical.com>
b1bcb2
Date: Thu, 7 Jan 2021 19:21:03 +0000
b1bcb2
Subject: [PATCH] kern/parser: Fix a stack buffer overflow
b1bcb2
b1bcb2
grub_parser_split_cmdline() expands variable names present in the supplied
b1bcb2
command line in to their corresponding variable contents and uses a 1 kiB
b1bcb2
stack buffer for temporary storage without sufficient bounds checking. If
b1bcb2
the function is called with a command line that references a variable with
b1bcb2
a sufficiently large payload, it is possible to overflow the stack
b1bcb2
buffer via tab completion, corrupt the stack frame and potentially
b1bcb2
control execution.
b1bcb2
b1bcb2
Fixes: CVE-2020-27749
b1bcb2
b1bcb2
Reported-by: Chris Coulson <chris.coulson@canonical.com>
b1bcb2
Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
b1bcb2
Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
b1bcb2
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b1bcb2
---
b1bcb2
 grub-core/kern/parser.c | 110 +++++++++++++++++++++++++++++-------------------
b1bcb2
 1 file changed, 67 insertions(+), 43 deletions(-)
b1bcb2
b1bcb2
diff --git a/grub-core/kern/parser.c b/grub-core/kern/parser.c
b1bcb2
index 16879f072fe..068b6d0fe57 100644
b1bcb2
--- a/grub-core/kern/parser.c
b1bcb2
+++ b/grub-core/kern/parser.c
b1bcb2
@@ -18,6 +18,7 @@
b1bcb2
  */
b1bcb2
 
b1bcb2
 #include <grub/parser.h>
b1bcb2
+#include <grub/buffer.h>
b1bcb2
 #include <grub/env.h>
b1bcb2
 #include <grub/misc.h>
b1bcb2
 #include <grub/mm.h>
b1bcb2
@@ -107,8 +108,8 @@ check_varstate (grub_parser_state_t s)
b1bcb2
 }
b1bcb2
 
b1bcb2
 
b1bcb2
-static void
b1bcb2
-add_var (char *varname, char **bp, char **vp,
b1bcb2
+static grub_err_t
b1bcb2
+add_var (grub_buffer_t varname, grub_buffer_t buf,
b1bcb2
 	 grub_parser_state_t state, grub_parser_state_t newstate)
b1bcb2
 {
b1bcb2
   const char *val;
b1bcb2
@@ -116,31 +117,41 @@ add_var (char *varname, char **bp, char **vp,
b1bcb2
   /* Check if a variable was being read in and the end of the name
b1bcb2
      was reached.  */
b1bcb2
   if (!(check_varstate (state) && !check_varstate (newstate)))
b1bcb2
-    return;
b1bcb2
+    return GRUB_ERR_NONE;
b1bcb2
 
b1bcb2
-  *((*vp)++) = '\0';
b1bcb2
-  val = grub_env_get (varname);
b1bcb2
-  *vp = varname;
b1bcb2
+  if (grub_buffer_append_char (varname, '\0') != GRUB_ERR_NONE)
b1bcb2
+    return grub_errno;
b1bcb2
+
b1bcb2
+  val = grub_env_get ((const char *) grub_buffer_peek_data (varname));
b1bcb2
+  grub_buffer_reset (varname);
b1bcb2
   if (!val)
b1bcb2
-    return;
b1bcb2
+    return GRUB_ERR_NONE;
b1bcb2
 
b1bcb2
   /* Insert the contents of the variable in the buffer.  */
b1bcb2
-  for (; *val; val++)
b1bcb2
-    *((*bp)++) = *val;
b1bcb2
+  return grub_buffer_append_data (buf, val, grub_strlen (val));
b1bcb2
 }
b1bcb2
 
b1bcb2
-static void
b1bcb2
-terminate_arg (char *buffer, char **bp, int *argc)
b1bcb2
+static grub_err_t
b1bcb2
+terminate_arg (grub_buffer_t buffer, int *argc)
b1bcb2
 {
b1bcb2
-  if (*bp != buffer && *((*bp) - 1) != '\0')
b1bcb2
-    {
b1bcb2
-      *((*bp)++) = '\0';
b1bcb2
-      (*argc)++;
b1bcb2
-    }
b1bcb2
+  grub_size_t unread = grub_buffer_get_unread_bytes (buffer);
b1bcb2
+
b1bcb2
+  if (unread == 0)
b1bcb2
+    return GRUB_ERR_NONE;
b1bcb2
+
b1bcb2
+  if (*(const char *) grub_buffer_peek_data_at (buffer, unread - 1) == '\0')
b1bcb2
+    return GRUB_ERR_NONE;
b1bcb2
+
b1bcb2
+  if (grub_buffer_append_char (buffer, '\0') != GRUB_ERR_NONE)
b1bcb2
+    return grub_errno;
b1bcb2
+
b1bcb2
+  (*argc)++;
b1bcb2
+
b1bcb2
+  return GRUB_ERR_NONE;
b1bcb2
 }
b1bcb2
 
b1bcb2
 static grub_err_t
b1bcb2
-process_char (char c, char *buffer, char **bp, char *varname, char **vp,
b1bcb2
+process_char (char c, grub_buffer_t buffer, grub_buffer_t varname,
b1bcb2
 	      grub_parser_state_t state, int *argc,
b1bcb2
 	      grub_parser_state_t *newstate)
b1bcb2
 {
b1bcb2
@@ -153,12 +164,13 @@ process_char (char c, char *buffer, char **bp, char *varname, char **vp,
b1bcb2
    * not describe the variable anymore, write the variable to
b1bcb2
    * the buffer.
b1bcb2
    */
b1bcb2
-  add_var (varname, bp, vp, state, *newstate);
b1bcb2
+  if (add_var (varname, buffer, state, *newstate) != GRUB_ERR_NONE)
b1bcb2
+    return grub_errno;
b1bcb2
 
b1bcb2
   if (check_varstate (*newstate))
b1bcb2
     {
b1bcb2
       if (use)
b1bcb2
-	*((*vp)++) = use;
b1bcb2
+        return grub_buffer_append_char (varname, use);
b1bcb2
     }
b1bcb2
   else if (*newstate == GRUB_PARSER_STATE_TEXT &&
b1bcb2
 	   state != GRUB_PARSER_STATE_ESC && grub_isspace (use))
b1bcb2
@@ -167,10 +179,10 @@ process_char (char c, char *buffer, char **bp, char *varname, char **vp,
b1bcb2
        * Don't add more than one argument if multiple
b1bcb2
        * spaces are used.
b1bcb2
        */
b1bcb2
-      terminate_arg (buffer, bp, argc);
b1bcb2
+      return terminate_arg (buffer, argc);
b1bcb2
     }
b1bcb2
   else if (use)
b1bcb2
-    *((*bp)++) = use;
b1bcb2
+    return grub_buffer_append_char (buffer, use);
b1bcb2
 
b1bcb2
   return GRUB_ERR_NONE;
b1bcb2
 }
b1bcb2
@@ -181,19 +193,22 @@ grub_parser_split_cmdline (const char *cmdline,
b1bcb2
 			   int *argc, char ***argv)
b1bcb2
 {
b1bcb2
   grub_parser_state_t state = GRUB_PARSER_STATE_TEXT;
b1bcb2
-  /* XXX: Fixed size buffer, perhaps this buffer should be dynamically
b1bcb2
-     allocated.  */
b1bcb2
-  char buffer[1024];
b1bcb2
-  char *bp = buffer;
b1bcb2
+  grub_buffer_t buffer, varname;
b1bcb2
   char *rd = (char *) cmdline;
b1bcb2
   char *rp = rd;
b1bcb2
-  char varname[200];
b1bcb2
-  char *vp = varname;
b1bcb2
-  char *args;
b1bcb2
   int i;
b1bcb2
 
b1bcb2
   *argc = 0;
b1bcb2
   *argv = NULL;
b1bcb2
+
b1bcb2
+  buffer = grub_buffer_new (1024);
b1bcb2
+  if (buffer == NULL)
b1bcb2
+    return grub_errno;
b1bcb2
+
b1bcb2
+  varname = grub_buffer_new (200);
b1bcb2
+  if (varname == NULL)
b1bcb2
+    goto fail;
b1bcb2
+
b1bcb2
   do
b1bcb2
     {
b1bcb2
       if (rp == NULL || *rp == '\0')
b1bcb2
@@ -219,7 +234,7 @@ grub_parser_split_cmdline (const char *cmdline,
b1bcb2
 	{
b1bcb2
 	  grub_parser_state_t newstate;
b1bcb2
 
b1bcb2
-	  if (process_char (*rp, buffer, &bp, varname, &vp, state, argc,
b1bcb2
+	  if (process_char (*rp, buffer, varname, state, argc,
b1bcb2
 			    &newstate) != GRUB_ERR_NONE)
b1bcb2
 	    goto fail;
b1bcb2
 
b1bcb2
@@ -230,10 +245,12 @@ grub_parser_split_cmdline (const char *cmdline,
b1bcb2
 
b1bcb2
   /* A special case for when the last character was part of a
b1bcb2
      variable.  */
b1bcb2
-  add_var (varname, &bp, &vp, state, GRUB_PARSER_STATE_TEXT);
b1bcb2
+  if (add_var (varname, buffer, state, GRUB_PARSER_STATE_TEXT) != GRUB_ERR_NONE)
b1bcb2
+    goto fail;
b1bcb2
 
b1bcb2
   /* Ensure that the last argument is terminated. */
b1bcb2
-  terminate_arg (buffer, &bp, argc);
b1bcb2
+  if (terminate_arg (buffer, argc) != GRUB_ERR_NONE)
b1bcb2
+    goto fail;
b1bcb2
 
b1bcb2
   /* If there are no args, then we're done. */
b1bcb2
   if (!*argc)
b1bcb2
@@ -242,38 +259,45 @@ grub_parser_split_cmdline (const char *cmdline,
b1bcb2
       goto out;
b1bcb2
     }
b1bcb2
 
b1bcb2
-  /* Reserve memory for the return values.  */
b1bcb2
-  args = grub_malloc (bp - buffer);
b1bcb2
-  if (!args)
b1bcb2
-    goto fail;
b1bcb2
-  grub_memcpy (args, buffer, bp - buffer);
b1bcb2
-
b1bcb2
   *argv = grub_calloc (*argc + 1, sizeof (char *));
b1bcb2
   if (!*argv)
b1bcb2
     goto fail;
b1bcb2
 
b1bcb2
   /* The arguments are separated with 0's, setup argv so it points to
b1bcb2
      the right values.  */
b1bcb2
-  bp = args;
b1bcb2
   for (i = 0; i < *argc; i++)
b1bcb2
     {
b1bcb2
-      (*argv)[i] = bp;
b1bcb2
-      while (*bp)
b1bcb2
-	bp++;
b1bcb2
-      bp++;
b1bcb2
+      char *arg;
b1bcb2
+
b1bcb2
+      if (i > 0)
b1bcb2
+	{
b1bcb2
+	  if (grub_buffer_advance_read_pos (buffer, 1) != GRUB_ERR_NONE)
b1bcb2
+	    goto fail;
b1bcb2
+	}
b1bcb2
+
b1bcb2
+      arg = (char *) grub_buffer_peek_data (buffer);
b1bcb2
+      if (arg == NULL ||
b1bcb2
+	  grub_buffer_advance_read_pos (buffer, grub_strlen (arg)) != GRUB_ERR_NONE)
b1bcb2
+	goto fail;
b1bcb2
+
b1bcb2
+      (*argv)[i] = arg;
b1bcb2
     }
b1bcb2
 
b1bcb2
+  /* Keep memory for the return values. */
b1bcb2
+  grub_buffer_take_data (buffer);
b1bcb2
+
b1bcb2
   grub_errno = GRUB_ERR_NONE;
b1bcb2
 
b1bcb2
  out:
b1bcb2
   if (rd != cmdline)
b1bcb2
     grub_free (rd);
b1bcb2
+  grub_buffer_free (buffer);
b1bcb2
+  grub_buffer_free (varname);
b1bcb2
 
b1bcb2
   return grub_errno;
b1bcb2
 
b1bcb2
  fail:
b1bcb2
   grub_free (*argv);
b1bcb2
-  grub_free (args);
b1bcb2
   goto out;
b1bcb2
 }
b1bcb2