Blame SOURCES/0322-acpi-Don-t-register-the-acpi-command-when-locked-dow.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
9723a8
From: Javier Martinez Canillas <javierm@redhat.com>
9723a8
Date: Mon, 28 Sep 2020 20:08:41 +0200
9723a8
Subject: [PATCH] acpi: Don't register the acpi command when locked down
9723a8
MIME-Version: 1.0
9723a8
Content-Type: text/plain; charset=UTF-8
9723a8
Content-Transfer-Encoding: 8bit
9723a8
9723a8
The command is not allowed when lockdown is enforced. Otherwise an
9723a8
attacker can instruct the GRUB to load an SSDT table to overwrite
9723a8
the kernel lockdown configuration and later load and execute
9723a8
unsigned code.
9723a8
9723a8
Fixes: CVE-2020-14372
9723a8
9723a8
Reported-by: Máté Kukri <km@mkukri.xyz>
9723a8
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
9723a8
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
9723a8
---
9723a8
 grub-core/commands/acpi.c | 15 ++++++++-------
9723a8
 docs/grub.texi            |  5 +++++
9723a8
 2 files changed, 13 insertions(+), 7 deletions(-)
9723a8
9723a8
diff --git a/grub-core/commands/acpi.c b/grub-core/commands/acpi.c
9723a8
index 9f02f22019a..a2912989b5c 100644
9723a8
--- a/grub-core/commands/acpi.c
9723a8
+++ b/grub-core/commands/acpi.c
9723a8
@@ -27,6 +27,7 @@
9723a8
 #include <grub/mm.h>
9723a8
 #include <grub/memory.h>
9723a8
 #include <grub/i18n.h>
9723a8
+#include <grub/lockdown.h>
9723a8
 
9723a8
 #ifdef GRUB_MACHINE_EFI
9723a8
 #include <grub/efi/efi.h>
9723a8
@@ -775,13 +776,13 @@ static grub_extcmd_t cmd;
9723a8
 
9723a8
 GRUB_MOD_INIT(acpi)
9723a8
 {
9723a8
-  cmd = grub_register_extcmd ("acpi", grub_cmd_acpi, 0,
9723a8
-			      N_("[-1|-2] [--exclude=TABLE1,TABLE2|"
9723a8
-			      "--load-only=TABLE1,TABLE2] FILE1"
9723a8
-			      " [FILE2] [...]"),
9723a8
-			      N_("Load host ACPI tables and tables "
9723a8
-			      "specified by arguments."),
9723a8
-			      options);
9723a8
+  cmd = grub_register_extcmd_lockdown ("acpi", grub_cmd_acpi, 0,
9723a8
+                                       N_("[-1|-2] [--exclude=TABLE1,TABLE2|"
9723a8
+                                          "--load-only=TABLE1,TABLE2] FILE1"
9723a8
+                                          " [FILE2] [...]"),
9723a8
+                                       N_("Load host ACPI tables and tables "
9723a8
+                                          "specified by arguments."),
9723a8
+                                       options);
9723a8
 }
9723a8
 
9723a8
 GRUB_MOD_FINI(acpi)
9723a8
diff --git a/docs/grub.texi b/docs/grub.texi
9723a8
index 6f5efaace32..a724d0712ed 100644
9723a8
--- a/docs/grub.texi
9723a8
+++ b/docs/grub.texi
9723a8
@@ -4033,6 +4033,11 @@ Normally, this command will replace the Root System Description Pointer
9723a8
 (RSDP) in the Extended BIOS Data Area to point to the new tables. If the
9723a8
 @option{--no-ebda} option is used, the new tables will be known only to
9723a8
 GRUB, but may be used by GRUB's EFI emulation.
9723a8
+
9723a8
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
9723a8
+      Otherwise an attacker can instruct the GRUB to load an SSDT table to
9723a8
+      overwrite the kernel lockdown configuration and later load and execute
9723a8
+      unsigned code.
9723a8
 @end deffn
9723a8
 
9723a8