mirror of
https://src.fedoraproject.org/rpms/grub2.git
synced 2024-11-24 14:32:58 +00:00
f0ad2aaa26
Resolves: CVE-2022-28736 CVE-2022-28735 CVE-2022-28734 CVE-2022-28733 Resolves: CVE-2021-3697 CVE-2021-3696 CVE-2021-3695 Signed-off-by: Robbie Harwood <rharwood@redhat.com>
81 lines
2.6 KiB
Diff
81 lines
2.6 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Peter Jones <pjones@redhat.com>
|
|
Date: Fri, 25 Mar 2022 15:40:12 -0400
|
|
Subject: [PATCH] pe: add the DOS header struct and fix some bad naming.
|
|
|
|
In order to properly validate a loaded kernel's support for being loaded
|
|
without a writable stack or executable, we need to be able to properly
|
|
parse arbitrary PE headers.
|
|
|
|
Currently, pe32.h is written in such a way that the MS-DOS header that
|
|
tells us where to find the PE header in the binary can't be accessed.
|
|
Further, for some reason it calls the DOS MZ magic "GRUB_PE32_MAGIC".
|
|
|
|
This patch adds the structure for the DOS header, renames the DOS magic
|
|
define, and adds defines for the actual PE magic.
|
|
|
|
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
---
|
|
grub-core/loader/arm64/linux.c | 2 +-
|
|
include/grub/efi/pe32.h | 28 ++++++++++++++++++++++++++--
|
|
2 files changed, 27 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
|
|
index d2af47c2c0..cc67f43906 100644
|
|
--- a/grub-core/loader/arm64/linux.c
|
|
+++ b/grub-core/loader/arm64/linux.c
|
|
@@ -58,7 +58,7 @@ grub_arch_efi_linux_check_image (struct linux_arch_kernel_header * lh)
|
|
if (lh->magic != GRUB_LINUX_ARMXX_MAGIC_SIGNATURE)
|
|
return grub_error(GRUB_ERR_BAD_OS, "invalid magic number");
|
|
|
|
- if ((lh->code0 & 0xffff) != GRUB_PE32_MAGIC)
|
|
+ if ((lh->code0 & 0xffff) != GRUB_DOS_MAGIC)
|
|
return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET,
|
|
N_("plain image kernel not supported - rebuild with CONFIG_(U)EFI_STUB enabled"));
|
|
|
|
diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h
|
|
index a43adf2746..2a5e1ee003 100644
|
|
--- a/include/grub/efi/pe32.h
|
|
+++ b/include/grub/efi/pe32.h
|
|
@@ -46,7 +46,30 @@
|
|
|
|
#define GRUB_PE32_MSDOS_STUB_SIZE 0x80
|
|
|
|
-#define GRUB_PE32_MAGIC 0x5a4d
|
|
+#define GRUB_DOS_MAGIC 0x5a4d
|
|
+
|
|
+struct grub_dos_header
|
|
+{
|
|
+ grub_uint16_t magic;
|
|
+ grub_uint16_t cblp;
|
|
+ grub_uint16_t cp;
|
|
+ grub_uint16_t crlc;
|
|
+ grub_uint16_t cparhdr;
|
|
+ grub_uint16_t minalloc;
|
|
+ grub_uint16_t maxalloc;
|
|
+ grub_uint16_t ss;
|
|
+ grub_uint16_t sp;
|
|
+ grub_uint16_t csum;
|
|
+ grub_uint16_t ip;
|
|
+ grub_uint16_t cs;
|
|
+ grub_uint16_t lfarlc;
|
|
+ grub_uint16_t ovno;
|
|
+ grub_uint16_t res0[4];
|
|
+ grub_uint16_t oemid;
|
|
+ grub_uint16_t oeminfo;
|
|
+ grub_uint16_t res1[10];
|
|
+ grub_uint32_t lfanew;
|
|
+};
|
|
|
|
/* According to the spec, the minimal alignment is 512 bytes...
|
|
But some examples (such as EFI drivers in the Intel
|
|
@@ -280,7 +303,8 @@ struct grub_pe32_section_table
|
|
|
|
|
|
|
|
-#define GRUB_PE32_SIGNATURE_SIZE 4
|
|
+#define GRUB_PE32_SIGNATURE_SIZE 4
|
|
+#define GRUB_PE32_SIGNATURE "PE\0\0"
|
|
|
|
struct grub_pe32_header
|
|
{
|