[SECURITY PATCH 52/73] disk: Check if returned pointer for allocated memory is NULL

From: Alec Brown When using grub_malloc(), grub_zalloc() or grub_calloc(), these functions can fail if we are out of memory. After allocating memory we should check if these functions returned NULL and handle this error if they did. On the occasion make a NULL check in ATA code more obvious. Si

[SECURITY PATCH 33/73] kern/dl: Fix for an integer overflow in grub_dl_ref()

From: B Horn It was possible to overflow the value of mod->ref_count, a signed integer, by repeatedly invoking insmod on an already loaded module. This led to a use-after-free. As once ref_count was overflowed it became possible to unload the module while there was still references to it. This r

[SECURITY PATCH 28/73] net: Unregister net_default_ip and net_default_mac variables hooks on unload

From: B Horn The net module is a dependency of normal. So, it shouldn't be possible to unload the net. Though unregister variables hooks as a precaution. It also gets in line with unregistering the other net module hooks. Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/net/net.c

[SECURITY PATCH 43/73] commands/read: Fix an integer overflow when supplying more than 2^31 characters

From: Jonathan Bar Or The grub_getline() function currently has a signed integer variable "i" that can be overflown when user supplies more than 2^31 characters. It results in a memory corruption of the allocated line buffer as well as supplying large negative values to grub_realloc(). Fixes: CV

[SECURITY PATCH 32/73] video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG

From: Daniel Axtens Otherwise a subsequent header could change the height and width allowing future OOB writes. Fixes: CVE-2024-45774 Reported-by: Nils Langius Signed-off-by: Daniel Axtens Reviewed-by: Daniel Kiper --- grub-core/video/readers/jpeg.c | 4 1 file changed, 4 insertions(+)

[SECURITY PATCH 34/73] kern/dl: Use correct segment in grub_dl_set_mem_attrs()

From: B Horn The previous code would never actually call grub_update_mem_attrs() as sh_info will always be zero for the sections that exist in memory. Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/kern/dl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletio

[SECURITY PATCH 40/73] gettext: Remove variables hooks on module unload

From: B Horn The gettext module does not entirely cleanup after itself in its GRUB_MOD_FINI() leaving a few variables hooks in place. It is not possible to unload gettext module because normal module depends on it. Though fix the issues for completeness. Fixes: CVE-2025-0622 Reported-by: B Horn

[SECURITY PATCH 53/73] disk/ieee1275/ofdisk: Call grub_ieee1275_close() when grub_malloc() fails

From: Alec Brown In the dev_iterate() function a handle is opened but isn't closed when grub_malloc() returns NULL. We should fix this by closing it on error. Signed-off-by: Alec Brown Reviewed-by: Daniel Kiper --- grub-core/disk/ieee1275/ofdisk.c | 5 - 1 file changed, 4 insertions(+), 1

[SECURITY PATCH 37/73] commands/ls: Fix NULL dereference

From: B Horn The grub_strrchr() may return NULL when the dirname do not contain "/". This can happen on broken filesystems. Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/commands/ls.c | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a

[SECURITY PATCH 38/73] commands/pgp: Unregister the "check_signatures" hooks on module unload

From: B Horn If the hooks are not removed they can be called after the module has been unloaded leading to an use-after-free. Fixes: CVE-2025-0622 Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/commands/pgp.c | 2 ++ 1 file changed, 2 insertions(+) diff -

[SECURITY PATCH 51/73] disk: Prevent overflows when allocating memory for arrays

From: Alec Brown Use grub_calloc() when allocating memory for arrays to ensure proper overflow checks are in place. Signed-off-by: Alec Brown Reviewed-by: Daniel Kiper --- grub-core/disk/cryptodisk.c | 2 +- grub-core/disk/lvm.c| 6 ++ 2 files changed, 3 insertions(+), 5 deletions

[SECURITY PATCH 54/73] fs: Use safe math macros to prevent overflows

From: Lidong Chen Replace direct arithmetic operations with macros from include/grub/safemath.h to prevent potential overflow issues when calculating the memory sizes. Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper --- grub-core/fs/archelp.c | 9 - grub-core/fs/btrfs.c

[SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

From: Daniel Axtens The idea is to permit the following: btrfs, cpio, exfat, ext, f2fs, fat, hfsplus, iso9660, squash4, tar, xfs and zfs. The JFS, ReiserFS, romfs, UDF and UFS security vulnerabilities were reported by Jonathan Bar Or . Fixes: CVE-2025-0677 Fixes: CVE-2025-0684 Fixes: CVE-2025-0

[SECURITY PATCH 64/73] fs/sfs: Check if allocated memory is NULL

From: Alec Brown When using grub_zalloc(), if we are out of memory, this function can fail. After allocating memory, we should check if grub_zalloc() returns NULL. If so, we should handle this error. Fixes: CID 473856 Signed-off-by: Alec Brown Reviewed-by: Ross Philipson Reviewed-by: Daniel K

[SECURITY PATCH 58/73] fs/zfs: Prevent overflows when allocating memory for arrays

From: Lidong Chen Use grub_calloc() when allocating memory for arrays to ensure proper overflow checks are in place. Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper --- grub-core/fs/zfs/zfs.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/grub-core/fs/zfs/zfs

[SECURITY PATCH 67/73] misc: Ensure consistent overflow error messages

From: Lidong Chen Update the overflow error messages to make them consistent across the GRUB code. Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper --- grub-core/fs/ntfs.c | 2 +- grub-core/fs/ntfscomp.c | 2 +- grub-core/video/readers/png.c | 2 +- 3 files changed, 3 inse

[SECURITY PATCH 55/73] fs: Prevent overflows when allocating memory for arrays

From: Lidong Chen Use grub_calloc() when allocating memory for arrays to ensure proper overflow checks are in place. The HFS+ and squash4 security vulnerabilities were reported by Jonathan Bar Or . Fixes: CVE-2025-0678 Fixes: CVE-2025-1125 Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper

[SECURITY PATCH 60/73] fs/zfs: Add missing NULL check after grub_strdup() call

From: Lidong Chen Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper --- grub-core/fs/zfs/zfs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/grub-core/fs/zfs/zfs.c b/grub-core/fs/zfs/zfs.c index 6a964974f..376042631 100644 --- a/grub-core/fs/zfs/zfs.c +++ b/grub-core/fs/zfs/zfs.c @@

[SECURITY PATCH 41/73] gettext: Integer overflow leads to heap OOB write or read

From: Lidong Chen Calculation of ctx->grub_gettext_msg_list size in grub_mofile_open() may overflow leading to subsequent OOB write or read. This patch fixes the issue by replacing grub_zalloc() and explicit multiplication with grub_calloc() which does the same thing in safe manner. Fixes: CVE-2

[SECURITY PATCH 44/73] commands/test: Stack overflow due to unlimited recursion depth

From: Lidong Chen The test_parse() evaluates test expression recursively. Due to lack of recursion depth check a specially crafted expression may cause a stack overflow. The recursion is only triggered by the parentheses usage and it can be unlimited. However, sensible expressions are unlikely to

[SECURITY PATCH 71/73] kern/misc: Add sanity check after grub_strtoul() call

From: Lidong Chen When the format string, fmt0, includes a positional argument grub_strtoul() or grub_strtoull() is called to extract the argument position. However, the returned argument position isn't fully validated. If the format is something like "%0$x" then these functions return 0 which le

[SECURITY PATCH 73/73] loader/i386/bsd: Use safe math to avoid underflow

From: Alec Brown The operation kern_end - kern_start may underflow when we input it into grub_relocator_alloc_chunk_addr() call. To avoid this we can use safe math for this subtraction. Fixes: CID 73845 Signed-off-by: Alec Brown Reviewed-by: Daniel Kiper --- grub-core/loader/i386/bsd.c | 14

[SECURITY PATCH 65/73] script/execute: Fix potential underflow and NULL dereference

From: Lidong Chen The result is initialized to 0 in grub_script_arglist_to_argv(). If the for loop condition is not met both result.args and result.argc remain 0 causing result.argc - 1 to underflow and/or result.args NULL dereference. Fix the issues by adding relevant checks. Fixes: CID 473880

[SECURITY PATCH 48/73] fs/bfs: Disable under lockdown

From: Daniel Axtens The BFS is not fuzz-clean. Don't allow it to be loaded under lockdown. This will also disable the AFS. Fixes: CVE-2024-45778 Fixes: CVE-2024-45779 Reported-by: Nils Langius Signed-off-by: Daniel Axtens Reviewed-by: Daniel Kiper --- grub-core/fs/bfs.c | 11 --- 1

[SECURITY PATCH 57/73] fs/zfs: Use safe math macros to prevent overflows

From: Lidong Chen Replace direct arithmetic operations with macros from include/grub/safemath.h to prevent potential overflow issues when calculating the memory sizes. Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper --- grub-core/fs/zfs/zfs.c | 50

[SECURITY PATCH 45/73] commands/minicmd: Block the dump command in lockdown mode

From: B Horn The dump enables a user to read memory which should not be possible in lockdown mode. Fixes: CVE-2025-1118 Reported-by: B Horn Reported-by: Jonathan Bar Or Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/commands/minicmd.c | 4 ++-- 1 file changed, 2 insertions(+

[SECURITY PATCH 68/73] bus/usb/ehci: Define GRUB_EHCI_TOGGLE as grub_uint32_t

From: Alec Brown The Coverity indicates that GRUB_EHCI_TOGGLE is an int that contains a negative value and we are using it for the variable token which is grub_uint32_t. To remedy this we can cast the definition to grub_uint32_t. Fixes: CID 473851 Signed-off-by: Alec Brown Reviewed-by: Daniel

[SECURITY PATCH 69/73] normal/menu: Use safe math to avoid an integer overflow

From: Alec Brown The Coverity indicates that the variable current_entry might overflow. To prevent this use safe math when adding GRUB_MENU_PAGE_SIZE to current_entry. On the occasion fix limiting condition which was broken. Fixes: CID 473853 Signed-off-by: Alec Brown Reviewed-by: Daniel Kipe

[SECURITY PATCH 26/73] kern/partition: Limit recursion in part_iterate()

From: B Horn The part_iterate() is used by grub_partition_iterate() as a callback in the partition iterate functions. However, part_iterate() may also call the partition iterate functions which may lead to recursion. Fix potential issue by limiting the recursion depth. Signed-off-by: B Horn Rev

[SECURITY PATCH 70/73] kern/partition: Add sanity check after grub_strtoul() call

From: Lidong Chen The current code incorrectly assumes that both the input and the values returned by grub_strtoul() are always valid which can lead to potential errors. This fix ensures proper validation to prevent any unintended issues. Fixes: CID 473843 Signed-off-by: Lidong Chen Reviewed-b

[SECURITY PATCH 56/73] fs: Prevent overflows when assigning returned values from read_number()

From: Lidong Chen The direct assignment of the unsigned long long value returned by read_number() can potentially lead to an overflow on a 32-bit systems. The fix replaces the direct assignments with calls to grub_cast() which detects the overflows and safely assigns the values if no overflow is

[SECURITY PATCH 61/73] net: Use safe math macros to prevent overflows

From: Lidong Chen Replace direct arithmetic operations with macros from include/grub/safemath.h to prevent potential overflow issues when calculating the memory sizes. Signed-off-by: Lidong Chen Signed-off-by: Alec Brown Reviewed-by: Daniel Kiper --- grub-core/net/bootp.c |

[SECURITY PATCH 63/73] net: Check if returned pointer for allocated memory is NULL

From: Alec Brown When using grub_malloc(), the function can fail if we are out of memory. After allocating memory we should check if this function returned NULL and handle this error if it did. Signed-off-by: Alec Brown Reviewed-by: Daniel Kiper --- grub-core/net/net.c | 5 + 1 file chang

[SECURITY PATCH 47/73] commands/hexdump: Disable memory reading in lockdown mode

From: B Horn Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/commands/hexdump.c | 7 ++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/grub-core/commands/hexdump.c b/grub-core/commands/hexdump.c index eaa12465b..d6f61d98a 100644 --- a/grub-

[SECURITY PATCH 42/73] gettext: Integer overflow leads to heap OOB write

From: Lidong Chen The size calculation of the translation buffer in grub_gettext_getstr_from_position() may overflow to 0 leading to heap OOB write. This patch fixes the issue by using grub_add() and checking for an overflow. Fixes: CVE-2024-45777 Reported-by: Nils Langius Signed-off-by: Lidon

[SECURITY PATCH 39/73] normal: Remove variables hooks on module unload

From: B Horn The normal module does not entirely cleanup after itself in its GRUB_MOD_FINI() leaving a few variables hooks in place. It is not possible to unload normal module now but fix the issues for completeness. On the occasion replace 0s with NULLs for "pager" variable hooks unregister. F

[SECURITY PATCH 13/73] fs/jfs: Inconsistent signed/unsigned types usage in return values

From: Lidong Chen The getblk() returns a value of type grub_int64_t which is assigned to iagblk and inoblk, both of type grub_uint64_t, in grub_jfs_read_inode() via grub_jfs_blkno(). This patch fixes the type mismatch in the functions. Additionally, the getblk() will return 0 instead of -1 on fai

[SECURITY PATCH 09/73] fs/iso9660: Fix invalid free

From: Michael Chang The ctx->filename can point to either a string literal or a dynamically allocated string. The ctx->filename_alloc field is used to indicate the type of allocation. An issue has been identified where ctx->filename is reassigned to a string literal in susp_iterate_dir() but ctx

[SECURITY PATCH 21/73] kern/file: Ensure file->data is set

From: B Horn This is to avoid a generic issue were some filesystems would not set data and also not set a grub_errno. This meant it was possible for many filesystems to grub_dl_unref() themselves multiple times resulting in it being possible to unload the filesystems while there were still refere

[SECURITY PATCH 20/73] fs/xfs: Ensuring failing to mount sets a grub_errno

From: B Horn It was previously possible for grub_xfs_mount() to return NULL without setting grub_errno if the XFS version was invalid. This resulted in it being possible for grub_dl_unref() to be called twice allowing the XFS module to be unloaded while there were still references to it. Fixing

[SECURITY PATCH 18/73] fs/ntfs: Implement attribute verification

From: B Horn It was possible to read OOB when an attribute had a size that exceeded the allocated buffer. This resolves that by making sure all attributes that get read are fully in the allocated space by implementing a function to validate them. Defining the offsets in include/grub/ntfs.h but t

[SECURITY PATCH 08/73] fs/iso9660: Set a grub_errno if mount fails

From: B Horn It was possible for a grub_errno to not be set if mount of an ISO 9660 filesystem failed when set_rockridge() returned 0. This isn't known to be exploitable as the other filesystems due to filesystem helper checking the requested file type. Though fixing as a precaution. Reported-b

[SECURITY PATCH 59/73] fs/zfs: Check if returned pointer for allocated memory is NULL

From: Lidong Chen When using grub_malloc() or grub_zalloc(), these functions can fail if we are out of memory. After allocating memory we should check if these functions returned NULL and handle this error if they did. Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper --- grub-core/fs/zfs/

[SECURITY PATCH 62/73] net: Prevent overflows when allocating memory for arrays

From: Lidong Chen Use grub_calloc() when allocating memory for arrays to ensure proper overflow checks are in place. Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper --- grub-core/net/dns.c | 4 ++-- grub-core/net/net.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --gi

[SECURITY PATCH 46/73] commands/memrw: Disable memory reading in lockdown mode

From: B Horn With the rest of module being blocked in lockdown mode it does not make a lot of sense to leave memory reading enabled. This also goes in par with disabling the dump command. Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/commands/memrw.c | 21

[SECURITY PATCH 66/73] osdep/unix/getroot: Fix potential underflow

From: Lidong Chen The entry_len is initialized in grub_find_root_devices_from_mountinfo() to 0 before the while loop iterates through /proc/self/mountinfo. If the file is empty or contains only invalid entries entry_len remains 0 causing entry_len - 1 in the subsequent for loop initialization to

[SECURITY PATCH 25/73] kern/disk: Limit recursion depth

From: B Horn The grub_disk_read() may trigger other disk reads, e.g. via loopbacks. This may lead to very deep recursion which can corrupt the heap. So, fix the issue by limiting reads depth. Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper --- grub-core/kern/disk.c | 27 +

Re: [SECURITY PATCH 00/73] GRUB2 vulnerabilities - 2025/02/18

Hi Didier, On Tue, Feb 18, 2025 at 07:33:03PM +, Didier Spaier wrote: > Hi Daniel and all, > > sorry for top posting but this is a question and a request, not a comment. > > maintaining a distribution alone I can't afford to carry as many patches as > Debian, so: could please mention the commi

Re: [SECURITY PATCH 00/73] GRUB2 vulnerabilities - 2025/02/18

On Mon, Mar 03, 2025 at 08:55:45AM +0100, Christian Hesse wrote: > Daniel Kiper on Fri, 2025/02/28 13:57: > > On Thu, Feb 27, 2025 at 11:03:44AM +0100, Christian Hesse wrote: > > > Daniel Kiper via Grub-devel on Mon, 2025/02/24 > > > 15:34: > > > > > [..

Re: [PATCH 0/2] docs: Update Documentation for Lockdown Changes

On Fri, Feb 28, 2025 at 03:55:22PM -0600, Andrew Hamilton wrote: > Make some updates to the GRUB documentation around which file systems > are allowed / disallowed in lockdown, as well as additional Commands > now blocked in lockdown mode. > > Andrew Hamilton (2): > docs: Document Restricted File

Re: Feedback Request: Implement Fuzzers and Add to OSS-Fuzz

Adding Daniel Axtens, Lidong and Nils... On Thu, Feb 27, 2025 at 01:22:15PM -0500, Andrew Hamilton wrote: > Hello, > > I’m looking for feedback on whether there would be project interest / support > on me creating an initial fuzz test suite for some core GRUB functions and > then > integrating th

Re: [SECURITY PATCH 18/73] fs/ntfs: Implement attribute verification

&& *at->attr_cur != 0xFF) > > but I don't understand half of what that code actually does, > so I can't vouch for correctness (not sending it as a patch). > > Also filed here https://savannah.gnu.org/bugs/index.php?66855 > > and here > https://gitlab.archlinux

Re: [SECURITY PATCH 00/73] GRUB2 vulnerabilities - 2025/02/18

On Thu, Feb 27, 2025 at 11:03:44AM +0100, Christian Hesse wrote: > Daniel Kiper via Grub-devel on Mon, 2025/02/24 15:34: > > > [...] > > > The current situation is just insane. > > > > I can understand your frustration but I am afraid we are not able to do >

Re: [PATCH v3] powerpc: increase MIN RMA size for CAS negotiation

On Wed, Mar 12, 2025 at 10:06:15PM +0530, Avnish Chouhan wrote: > Change RMA size from 512 MB to 768 MB which will result > in more memory at boot time for PowerPC. When vTPM, Secure Boot or > FADump are enabled on PowerPC, the 512 MB RMA memory is not sufficient for > booting. With this 512 MB RMA

Re: [SECURITY PATCH 49/73] fs: Disable many filesystems under lockdown

On Wed, Feb 19, 2025 at 09:43:59AM -0600, Andrew Hamilton wrote: > It seems this may impact some users attempting to use secure boot, I think I > understand the reasoning behind this but maybe we should have something on the > roadmap or issue tracker for what it would take to get these file system

Re: [SECURITY PATCH 00/73] GRUB2 vulnerabilities - 2025/02/18

On Fri, Feb 21, 2025 at 11:06:54AM +0100, Christian Hesse wrote: > Daniel Kiper via Grub-devel on Tue, 2025/02/18 19:00: > > I am posting all the GRUB2 upstream patches which fix all security bugs > > found and reported up until now. Major Linux distros carry or will carry >

Re: [PATCH 1/1] gdb: typo hueristic

On Thu, Jan 16, 2025 at 06:45:29AM -0800, ross.philip...@oracle.com wrote: > On 1/16/25 4:25 AM, Heinrich Schuchardt wrote: > > %s/hueristic/heuristic/ > > > > Signed-off-by: Heinrich Schuchardt > > --- > > grub-core/gdb_helper.py.in | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > >

Re: [PATCH v3 05/10] tss2: Add TPM 2.0 NV index commands

On Mon, Jan 13, 2025 at 11:07:08AM +0800, Gary Lin wrote: > The following TPM 2.0 commands are introduced to tss2 to access the > TPM non-volatile memory associated with the NV index handles. > > - TPM2_NV_DefineSpace > - TPM2_NV_UndefineSpace > - TPM2_NV_ReadPublic > - TPM2_NV_Read > - TPM2_NV_Wri

Re: [PATCH 0/5] Fix memory leaks

On Thu, Mar 27, 2025 at 05:56:30PM +, Lidong Chen wrote: > These patches address memory leaks identified by Coverity. > > Lidong Chen (5): > disk/ldm: Fix memory leaks > lib/reloacator: Fix memory leaks > loader/i386/linux: Fix resource leak > fs/btrfs: Fix memory leaks > loader/xnu:

Re: [PATCH v4 05/12] tpm2_key_protector: Unseal key from a buffer

On Fri, Mar 21, 2025 at 03:59:01PM +0800, Gary Lin wrote: > Extract the logic to handle the file buffer from the SRK recover > function to prepare to load the sealed key from the NV index handle, > so the NV index mode can share the same code path in the later patch. > The SRK recover function now

[SECURITY PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication

From: Maxim Suhanov This further mitigates potential misuse of the CLI after the root device has been successfully unlocked via TPM. Fixes: CVE-2025-4382 Signed-off-by: Maxim Suhanov Reviewed-by: Daniel Kiper --- grub-core/kern/rescue_reader.c | 2 +- 1 file changed, 1 insertion(+), 1 deleti

[SECURITY PATCH 00/08] GRUB2 vulnerabilities - 2025/05/08

Hi all, This patch set contains a bundle of fixes for various security flaws discovered, as part of a pro-active hardening effort, in the GRUB2 code recently. The most severe one, i.e. potentially exploitable, has CVE assigned and is listed at the end of this email. Details of exactly what needs

[SECURITY PATCH 2/8] commands/search: Introduce the --cryptodisk-only argument

From: Maxim Suhanov This allows users to restrict the "search" command's scope to encrypted disks only. Typically, this command is used to "rebase" $root and $prefix before loading additional configuration files via "source" or "configfile". Unfortunately, this leads to security problems, like C

[SECURITY PATCH 1/8] kern/rescue_reader: Block the rescue mode until the CLI authentication

From: Maxim Suhanov This further mitigates potential misuse of the CLI after the root device has been successfully unlocked via TPM. Fixes: CVE-2025-4382 Signed-off-by: Maxim Suhanov Reviewed-by: Daniel Kiper --- grub-core/kern/rescue_reader.c | 2 +- 1 file changed, 1 insertion(+), 1 deleti

[SECURITY PATCH 3/8] disk/diskfilter: Introduce the "cryptocheck" command

From: Maxim Suhanov This command examines a given diskfilter device, e.g., an LVM disk, and checks if underlying disks, physical volumes, are cryptodisks, e.g., LUKS disks, this layout is called "LVM-on-LUKS". The return value is 0 when all underlying disks (of a given device) are cryptodisks (1

[SECURITY PATCH 4/8] commands/search: Add the diskfilter support

From: Maxim Suhanov When the --cryptodisk-only argument is given, also check the target device using the "cryptocheck" command, if available. This extends the checks to common layouts like LVM-on-LUKS, so the --cryptodisk-only argument transparently handles such setups. Signed-off-by: Maxim Suh

[SECURITY PATCH 8/8] cryptocheck: Add --quiet option

From: Michael Chang The option can be used to suppress output if we only want to test the return value of the command. Also, mention this option in the documentation. Signed-off-by: Michael Chang Signed-off-by: Maxim Suhanov Reviewed-by: Daniel Kiper --- docs/grub.texi | 4 +++

[SECURITY PATCH 5/8] docs: Document available crypto disks checks

From: Maxim Suhanov Document the --cryptodisk-only argument. Also, document the "cryptocheck" command invoked when that argument is processed. Signed-off-by: Maxim Suhanov Reviewed-by: Daniel Kiper --- docs/grub.texi | 24 +++- 1 file changed, 23 insertions(+), 1 deletion(

[SECURITY PATCH 7/8] disk/cryptodisk: Wipe the passphrase from memory

From: Maxim Suhanov Switching to another EFI boot application while there are secrets in RAM is dangerous, because not all firmware is wiping memory on free. To reduce the attack surface, wipe the passphrase acquired when unlocking an encrypted volume. Signed-off-by: Maxim Suhanov Reviewed-by:

[SECURITY PATCH 6/8] disk/cryptodisk: Add the "erase secrets" function

From: Maxim Suhanov This commit adds the grub_cryptodisk_erasesecrets() function to wipe master keys from all cryptodisks. This function is EFI-only. Since there is no easy way to "force unmount" a given encrypted disk, this function renders all mounted cryptodisks unusable. An attempt to read t

Re: [SECURITY PATCH 00/08] GRUB2 vulnerabilities - 2025/05/08

On Fri, May 09, 2025 at 09:47:05AM +0200, Christian Hesse wrote: > Daniel Kiper on Thu, 2025/05/08 19:02: > > [...] Now all the GRUB2 upstream patches are in > > the GRUB2 git repository [2] too. > > > > [...] > > > > [2] https://git.savannah.gnu.org/gitweb/?p=grub.git > > https://git.savannah

Re: [PATCH v2 2/2] cmdline: fix command line parsing in grub

On Mon, May 19, 2025 at 11:49:55PM +0530, Shreenidhi Shedi wrote: > From: Shreenidhi Shedi > > Previously, the command line construction function > (grub_create_loader_cmdline) escaped single and double quotes, which is > unnecessary and potentially problematic since the kernel command line > hand

Re: [PATCH v2 1/2] envblk: ignore empty new lines while parsing env files

On Mon, May 19, 2025 at 11:49:54PM +0530, Shreenidhi Shedi wrote: > From: Shreenidhi Shedi > > Environment files may contain empty lines, which should be > ignored during parsing. Currently, these lines are not skipped and > resulting in incorrect behavior. This patch adds a check to skip empty >

Re: [PATCH v2 1/4] fs/ntfs: Correct regression with run list calculation

On Mon, May 19, 2025 at 09:03:15PM -0500, Andrew Hamilton wrote: > Correct ntfs_test test failures around attempting to validate attribute > run list values. The calculation was incorrect for the 'curr' variable. > With previous calculation, some file systems would fail validation > despite being w

Re: [PATCH v2 2/4] fs/ntfs: Correct attribute vs attribute list validation

On Mon, May 19, 2025 at 09:03:16PM -0500, Andrew Hamilton wrote: > Correct ntfs_test test failures around attempting to validate attribute > list entries as attributes. The NTFS code uses common logic in some > places to parse both attributes and attribute_lists which complicates > validation. Attr

Re: [PATCH v2 4/4] fs/ntfs: Correct possible access violations and hangs

I think you should change the order of this patch and patch #3. On Mon, May 19, 2025 at 09:03:18PM -0500, Andrew Hamilton wrote: > Correct several memory access violations and hangs found during fuzzing. > The issues fixed here could occur if certain specific malformed NTFS > file systems were pre

Re: [PATCH v2 3/4] fs/fshelp: Avoid possible NULL pointer deference

On Mon, May 19, 2025 at 09:03:17PM -0500, Andrew Hamilton wrote: > Avoid attempting to defererence a NULL pointer to call read_symlink when > the given filesystem does not provide a read_symlink function. This could > be triggered if the calling filesystem had a file marked as a symlink. > This app

Re: [PATCH 1/2] envblk: ignore empty new lines while parsing env files

On Thu, May 15, 2025 at 12:44:27PM +0530, Shreenidhi Shedi wrote: > From: Shreenidhi Shedi > > Signed-off-by: Shreenidhi Shedi Both patches are missing explanations why they are needed and/or what kind of issues they are fixing. I do not mention cover letter... Daniel _

Re: [PATCH 0/2] commands/efi: Fix sevral memory leaks

On Tue, May 20, 2025 at 05:40:17PM +, khaalid cali wrote: > "handles" that "grub_efi_locate_handles" was allocated with "grub_malloc" > wasn't being freed. The "handles" allocated by grub_efi_locate_handle() call are not always freed. Add missing grub_free() calls. > Signed-off-by: Khalid Al

Re: [PATCH v3 0/5] fs: Test failure fixes and fuzzer fixes

On Wed, May 21, 2025 at 10:20:36PM -0500, Andrew Hamilton wrote: > Correct some NTFS test failures introduced by previous fixes for CVEs. > With these changes, the NTFS tests run successfully. > > Also correct some fuzzer identified crashes and hangs (in NTFS and one > that may in theory impact HFS

Re: [PATCH v2 0/2] Correct Build Failures with GCC-15 and CLANG

On Tue, Jun 17, 2025 at 08:58:24PM -0500, Andrew Hamilton wrote: > 1. Correct GRUB build with GCC >= 15 due to new GNULIB compile > warning detected by GCC. > > Pull in gnulib fix to allow base64.c to compile using GCC 15 or newer. > > Pulled from: GNULIB commit 25df6dc4253480a343dde3376ce6fd99c316

Re: [PATCH v2 0/3] Fixes for non-default TPM PCR banks

On Fri, Jun 13, 2025 at 03:02:32PM +0800, Gary Lin wrote: > There are two bugs when using the TPM PCR banks other than the default > SHA256 PCR bank: > > 1) Key unsealing failure > 2) Dumping the wrong PCR bank > > This patch set fixes the above two bugs and adds the tests for SHA384 > PCR bank. >

Re: [PATCH v2] lib/LzmaEnc: Validate 'len' before subtracting

On Thu, Jun 12, 2025 at 12:03:58AM +, Lidong Chen wrote: > In LzmaEnc_CodeOneBlock(), both GetOptimumFast() and GetOptimum() > returns a value of greater or equal to 1, which is assigned to > 'len'. But since LZMA_MATCH_LEN_MIN == 2, 'len' should be validated > before performing "len - LZMA_MAT

Re: [PATCH 0/2] build: Fixes to Building from dist Archive

On Tue, Jun 10, 2025 at 10:15:44PM -0500, Andrew Hamilton wrote: > Fix several issues with attempting to create and build from the > GRUB 'dist' archive. > > 1. extra_deps.lst is now automatically generated so remove this > from the archive to avoid a dependency on running make first. > > 2. Add ad

Re: [PATCH 0/2] Fix resource leaks in gnulib

On Tue, Jun 10, 2025 at 03:19:43PM +, Alec Brown wrote: > Coverity found a couple resource leaks in gnulib code that the GRUB is using. > These fixes have been made in the latest version of gnulib and I've backported > these changes to maintain consistency. > > This patch set fixes the followin

Re: [PATCH v4 3/4] blsuki: Check for mounted /boot in emu

On Wed, May 21, 2025 at 12:51:25PM +, Alec Brown wrote: > From: Robbie Harwood > > Irritatingly, BLS defines paths relative to the mountpoint of the > filesystem which contains its snippets, not / or any other fixed > location. So grub2-emu needs to know whether /boot is a separate > filesyste

Re: [PATCH v4 2/4] blsuki: Add blscfg command to parse Boot Loader Specification snippets

On Wed, May 21, 2025 at 12:51:24PM +, Alec Brown wrote: > From: Peter Jones > > The BootLoaderSpec (BLS) defines a scheme where different bootloaders can > share a format for boot items and a configuration directory that accepts > these common configurations as drop-in files. > > The BLS Speci

Re: [PATCH v4 4/4] blsuki: Add uki command to load Unified Kernel Image entries

On Wed, May 21, 2025 at 12:51:26PM +, Alec Brown wrote: > A Unified Kernel Image is a single UEFI PE file that combines a UEFI boot > stub, > a Linux kernel image, an initrd, and further resources. The uki command will > locate where the UKI file is and create a GRUB menu entry to load it. > >

Re: [PATCH 1/1] tests: Correct netboot and file_filter test failure

On Sat, Jun 21, 2025 at 10:50:38AM -0500, Andrew Hamilton wrote: > Correct a test failure in netboot_test and file_filter_test > caused by an issue cleaning up the tmp directory created > for netboot. Netboot creates a subdirectory in the tmp > folder that causes the rmdir to fail - so cleanup the

Re: [PATCH] normal/charset: Fix underflow and overflow in loop init

On Wed, Jun 18, 2025 at 07:24:23PM +, Lidong Chen wrote: > In bidi_line_wrap(), "kk - 1" in the for loop init, "i = kk - 1", > underflows when 'kk' (unsigned int) is 0. Assigning the result of > 'kk - 1' to signed int 'i' may cause overflow. To address both > issues, cast 'kk' to a signed type

Re: [PATCH 1/2] gnulib: Bring back the fix for resolving unused variable

On Wed, Jun 18, 2025 at 07:12:15PM +, Lidong Chen wrote: > This patch resolved a minor issue spotted by Coverity: > a983d36bd917 gnulib/regexec: Resolve unused variable > > But, it was removed by the gnulib update: > 2b7902459803 Update gnulib version and drop most gnulib patches > > It cau

Re: [PATCH] Revert "lzma: Make sure we don't dereference past array"

On Mon, Jun 23, 2025 at 05:42:32PM +, Lidong Chen wrote: > Commit 40e261b89b71 ensures that the variable len is at least 2. > As a result, GetLenToPosState(len) never returns a value greater > than or equal to kNumLenToPosStates, making the changes introduced > in the commit 16c0dbf4bc6a unreac

Re: [PATCH v4 1/4] kern/vercmp: Add functionality to compare kernel versions

On Wed, May 21, 2025 at 12:51:23PM +, Alec Brown wrote: > Add functionality to compare alpha and numeric version segments for kernels. I think this code applies not only for kernels. > This can be useful in sorting newer from older kernels. Where this code come from? Or maybe it is written f

Re: [PATCH] unix/hostdisk: Fix signed integer overflow

On Thu, Jun 05, 2025 at 05:03:19AM +, Lidong Chen wrote: > The potential overflow issue arises at "size += ret;" because 'size' > is of type ssize_t (signed) while 'len' is size_t (unsigned). Repeatedly > adding read sizes ('ret') to 'size' can potentially exceed the maximum > value of ssize_t,

Re: [PATCH] dl: fix grub_dl_is_persistent() for EMU

On Thu, Jul 03, 2025 at 12:41:26PM +0530, Sudhakar Kuppusamy wrote: > Reviewed-by: Sudhakar Kuppusamy Reviewed-by: Daniel Kiper Daniel ___ Grub-devel mailing list Grub-devel@gnu.org https://lists.gnu.org/mailman/listinfo/grub-devel

Re: [PATCH] loader/i386/pc/linux: Fix resource leak

On Tue, Jun 24, 2025 at 12:27:17AM +0530, sudhakar wrote: > On 2025-06-23 23:16, Lidong Chen via Grub-devel wrote: > > In grub_cmd_initrd(), memory is allocated for variable initrd_ctx > > before calling grub_relocator_alloc_chunk_align_safe(). When the > > function call fails, initrd_ctx should be

Re: [PATCH v5 1/5] kern/misc: Implement grub_strtok()

On Sun, Jul 27, 2025 at 01:54:32AM +, Alec Brown wrote: > Add the functions grub_strtok() and grub_strtok_r() to help parse strings into > tokens separated by characters in the 'delim' parameter. These functions are > present in gnulib but calling them directly from the gnulib code is quite > c

Re: [PATCH v5 1/5] kern/misc: Implement grub_strtok()

On Mon, Jul 28, 2025 at 02:21:50PM +0100, Frediano Ziglio wrote: > On Sun, Jul 27, 2025 at 2:57 AM Alec Brown via Grub-devel > wrote: > > > > Add the functions grub_strtok() and grub_strtok_r() to help parse strings > > into > > tokens separated by characters in the 'delim' parameter. These func

Re: [PATCH v5 1/5] kern/misc: Implement grub_strtok()

On Fri, Aug 01, 2025 at 04:51:54PM +0300, Vladimir 'phcoder' Serbinenko wrote: > Please don't put it into kernel unless it's used by the kernel. lib/ would be > a > better fit Whole family of grub_str*() functions live in grub-core/kern/misc.c. So, I am not sure why we should make an exception he

Re: [PATCH v5 2/5] blsuki: Add blscfg command to parse Boot Loader Specification snippets

On Sun, Jul 27, 2025 at 01:54:33AM +, Alec Brown wrote: > From: Peter Jones > > The BootLoaderSpec (BLS) defines a scheme where different bootloaders can > share a format for boot items and a configuration directory that accepts > these common configurations as drop-in files. > > The BLS Speci

<    1   2   3   >