Blame SOURCES/0378-mmap-Don-t-register-cutmem-and-badram-commands-when-.patch

468bd4
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
468bd4
From: Javier Martinez Canillas <javierm@redhat.com>
468bd4
Date: Wed, 14 Oct 2020 16:33:42 +0200
468bd4
Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown
468bd4
 is enforced
468bd4
468bd4
The cutmem and badram commands can be used to remove EFI memory regions
468bd4
and potentially disable the UEFI Secure Boot. Prevent the commands to be
468bd4
registered if the GRUB is locked down.
468bd4
468bd4
Fixes: CVE-2020-27779
468bd4
468bd4
Reported-by: Teddy Reed <teddy.reed@gmail.com>
468bd4
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
468bd4
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
468bd4
---
468bd4
 grub-core/mmap/mmap.c | 13 +++++++------
468bd4
 docs/grub.texi        |  4 ++++
468bd4
 2 files changed, 11 insertions(+), 6 deletions(-)
468bd4
468bd4
diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
468bd4
index 57b4e9a72a9..7ebf32e1e5e 100644
468bd4
--- a/grub-core/mmap/mmap.c
468bd4
+++ b/grub-core/mmap/mmap.c
468bd4
@@ -20,6 +20,7 @@
468bd4
 #include <grub/memory.h>
468bd4
 #include <grub/machine/memory.h>
468bd4
 #include <grub/err.h>
468bd4
+#include <grub/lockdown.h>
468bd4
 #include <grub/misc.h>
468bd4
 #include <grub/mm.h>
468bd4
 #include <grub/command.h>
468bd4
@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
468bd4
 
468bd4
 GRUB_MOD_INIT(mmap)
468bd4
 {
468bd4
-  cmd = grub_register_command ("badram", grub_cmd_badram,
468bd4
-			       N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
468bd4
-			       N_("Declare memory regions as faulty (badram)."));
468bd4
-  cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
468bd4
-				   N_("FROM[K|M|G] TO[K|M|G]"),
468bd4
-				   N_("Remove any memory regions in specified range."));
468bd4
+  cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
468bd4
+                                        N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
468bd4
+                                        N_("Declare memory regions as faulty (badram)."));
468bd4
+  cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
468bd4
+                                            N_("FROM[K|M|G] TO[K|M|G]"),
468bd4
+                                            N_("Remove any memory regions in specified range."));
468bd4
 
468bd4
 }
468bd4
 
468bd4
diff --git a/docs/grub.texi b/docs/grub.texi
468bd4
index 01acf672b80..f1675b6140c 100644
468bd4
--- a/docs/grub.texi
468bd4
+++ b/docs/grub.texi
468bd4
@@ -4103,6 +4103,10 @@ this page is to be filtered.  This syntax makes it easy to represent patterns
468bd4
 that are often result of memory damage, due to physical distribution of memory
468bd4
 cells.
468bd4
 
468bd4
+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
468bd4
+      This prevents removing EFI memory regions to potentially subvert the
468bd4
+      security mechanisms provided by the UEFI secure boot.
468bd4
+
468bd4
 @node blocklist
468bd4
 @subsection blocklist
468bd4