Blame SOURCES/0458-disk-lvm-Sanitize-rlocn-offset-to-prevent-wild-read.patch

468bd4
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
468bd4
From: Daniel Axtens <dja@axtens.net>
468bd4
Date: Fri, 22 Jan 2021 14:43:58 +1100
468bd4
Subject: [PATCH] disk/lvm: Sanitize rlocn->offset to prevent wild read
468bd4
468bd4
rlocn->offset is read directly from disk and added to the metadatabuf
468bd4
pointer to create a pointer to a block of metadata. It's a 64-bit
468bd4
quantity so as long as you don't overflow you can set subsequent
468bd4
pointers to point anywhere in memory.
468bd4
468bd4
Require that rlocn->offset fits within the metadata buffer size.
468bd4
468bd4
Signed-off-by: Daniel Axtens <dja@axtens.net>
468bd4
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
468bd4
---
468bd4
 grub-core/disk/lvm.c | 8 ++++++++
468bd4
 1 file changed, 8 insertions(+)
468bd4
468bd4
diff --git a/grub-core/disk/lvm.c b/grub-core/disk/lvm.c
f6e916
index 267be7b95..9eda28d85 100644
468bd4
--- a/grub-core/disk/lvm.c
468bd4
+++ b/grub-core/disk/lvm.c
468bd4
@@ -212,6 +212,14 @@ grub_lvm_detect (grub_disk_t disk,
468bd4
     }
468bd4
 
468bd4
   rlocn = mdah->raw_locns;
468bd4
+  if (grub_le_to_cpu64 (rlocn->offset) >= grub_le_to_cpu64 (mda_size))
468bd4
+    {
468bd4
+#ifdef GRUB_UTIL
468bd4
+      grub_util_info ("metadata offset is beyond end of metadata area");
468bd4
+#endif
468bd4
+      goto fail2;
468bd4
+    }
468bd4
+
468bd4
   if (grub_le_to_cpu64 (rlocn->offset) + grub_le_to_cpu64 (rlocn->size) >
468bd4
       grub_le_to_cpu64 (mdah->size))
468bd4
     {