grub2/0260-pe-add-the-DOS-header-struct-and-fix-some-bad-naming.patch
Robbie Harwood f0ad2aaa26 CVE fixes for 2022-05-24
Resolves: CVE-2022-28736 CVE-2022-28735 CVE-2022-28734 CVE-2022-28733
Resolves: CVE-2021-3697 CVE-2021-3696 CVE-2021-3695
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-06-03 13:54:45 -04:00

81 lines
2.6 KiB
Diff

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Fri, 25 Mar 2022 15:40:12 -0400
Subject: [PATCH] pe: add the DOS header struct and fix some bad naming.
In order to properly validate a loaded kernel's support for being loaded
without a writable stack or executable, we need to be able to properly
parse arbitrary PE headers.
Currently, pe32.h is written in such a way that the MS-DOS header that
tells us where to find the PE header in the binary can't be accessed.
Further, for some reason it calls the DOS MZ magic "GRUB_PE32_MAGIC".
This patch adds the structure for the DOS header, renames the DOS magic
define, and adds defines for the actual PE magic.
Signed-off-by: Peter Jones <pjones@redhat.com>
---
grub-core/loader/arm64/linux.c | 2 +-
include/grub/efi/pe32.h | 28 ++++++++++++++++++++++++++--
2 files changed, 27 insertions(+), 3 deletions(-)
diff --git a/grub-core/loader/arm64/linux.c b/grub-core/loader/arm64/linux.c
index d2af47c2c0..cc67f43906 100644
--- a/grub-core/loader/arm64/linux.c
+++ b/grub-core/loader/arm64/linux.c
@@ -58,7 +58,7 @@ grub_arch_efi_linux_check_image (struct linux_arch_kernel_header * lh)
if (lh->magic != GRUB_LINUX_ARMXX_MAGIC_SIGNATURE)
return grub_error(GRUB_ERR_BAD_OS, "invalid magic number");
- if ((lh->code0 & 0xffff) != GRUB_PE32_MAGIC)
+ if ((lh->code0 & 0xffff) != GRUB_DOS_MAGIC)
return grub_error (GRUB_ERR_NOT_IMPLEMENTED_YET,
N_("plain image kernel not supported - rebuild with CONFIG_(U)EFI_STUB enabled"));
diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h
index a43adf2746..2a5e1ee003 100644
--- a/include/grub/efi/pe32.h
+++ b/include/grub/efi/pe32.h
@@ -46,7 +46,30 @@
#define GRUB_PE32_MSDOS_STUB_SIZE 0x80
-#define GRUB_PE32_MAGIC 0x5a4d
+#define GRUB_DOS_MAGIC 0x5a4d
+
+struct grub_dos_header
+{
+ grub_uint16_t magic;
+ grub_uint16_t cblp;
+ grub_uint16_t cp;
+ grub_uint16_t crlc;
+ grub_uint16_t cparhdr;
+ grub_uint16_t minalloc;
+ grub_uint16_t maxalloc;
+ grub_uint16_t ss;
+ grub_uint16_t sp;
+ grub_uint16_t csum;
+ grub_uint16_t ip;
+ grub_uint16_t cs;
+ grub_uint16_t lfarlc;
+ grub_uint16_t ovno;
+ grub_uint16_t res0[4];
+ grub_uint16_t oemid;
+ grub_uint16_t oeminfo;
+ grub_uint16_t res1[10];
+ grub_uint32_t lfanew;
+};
/* According to the spec, the minimal alignment is 512 bytes...
But some examples (such as EFI drivers in the Intel
@@ -280,7 +303,8 @@ struct grub_pe32_section_table
-#define GRUB_PE32_SIGNATURE_SIZE 4
+#define GRUB_PE32_SIGNATURE_SIZE 4
+#define GRUB_PE32_SIGNATURE "PE\0\0"
struct grub_pe32_header
{