bugGNU GRUB - Bugs: bug #43601, Built-in gpg verification fails...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43601: Built-in gpg verification fails over tftp

Submitter:  Rob <rkliewer>
Submitted:  Thu 13 Nov 2014 03:53:48 PM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  Fixed Privacy:  Public
Assigned to:  arvidjaar Originator Name: 
Open/Closed:  Closed Release:  Git master
Release:  Reproducibility:  Every Time
Planned Release:  None

Fri 05 Dec 2014 06:22:25 PM UTC, comment #5: 

Fixed in ebb3d958aa2e1af8993c77018436bb14bec600b4. Thank you for testing.

Andrei Borzenkov <arvidjaar>
Group Member
Tue 18 Nov 2014 09:02:14 PM UTC, comment #4: 

Looks good.  I was able to fully boot with check_signatures on using tftp and http in both a legacy pxe build and an x86_64-efi build.  Thanks for your help.

Rob <rkliewer>
Tue 18 Nov 2014 07:16:45 PM UTC, comment #3: 

Thank you for tracing it down but your fix means memory leak. Please test attached patch which makes grub_pubkey_open to behave like other filter drivers. Commit message explains it in details.

(file #32464)

Andrei Borzenkov <arvidjaar>
Group Member
Tue 18 Nov 2014 03:36:19 PM UTC, comment #2: 

I believe I found the source of the issue.  When the device is a net device, grub_pubkey_open in verify.c closes the net device at the end with the grub_file_close(io) call even though that is not the intent (io->device is nulled before the free call, but the call back into grub_net_fs_close closes the device anyway).  When the function doing the original file operation (cat in my case) does it's close, the device is double freed and causes the memory corruption error.  I've attached a patch that skips the grub_file_close(io) step in grub_pubkey_open if the device is a net device.  This has fixed my issue without any adverse consequences.

(file #32459)

Rob <rkliewer>
Mon 17 Nov 2014 06:19:33 PM UTC, comment #1: 

The problem seems to originate during file closure.  I added debug logging to grub_file_close, logging messages before the fs close, device close, and file free.  I've attached a screenshot of the failure; at first I cat extbootopt without check_signatures set and then cat again with check_signatures set.  The device close seems to be the origin of the failure.

Rob <rkliewer>
Thu 13 Nov 2014 03:53:48 PM UTC, original submission:  

I am booting an x86_64 efi image over tftp on a vmware 10 instance. I'm seeing an issue in both grub 2.02~beta2 and the latest git when using a gpg public key with check_signatures enabled. All file operations over tftp (or http) complete, but grub immediately throws the following error:

alloc magic is broken at <addr>: <value> Aborted.
Press any key to exit.

Pressing a key takes me back to the EFI firmware. I can work around the issue by disabling check signatures and manually running verify_detached on a file, but that leaves me having to pull the kernel and initrd twice and nearly double my boot time. Signature checking from a memdisk does not appear to be broken.

Rob <rkliewer>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #32459:  verify.c.patch added by rkliewer (409B - application/octet-stream)
file #32455:  file.c.patch added by rkliewer (571B - application/octet-stream)
file #32454:  screencap.png added by rkliewer (15KiB - image/png)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by arvidjaar (Updated the item)
  • -email is unavailable- added by rkliewer (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-05 arvidjaar StatusNeed Info Fixed
        Open/ClosedAnalyzed Closed
    2014-11-18 arvidjaar Attached File- Added fix-use-after-free-in-pubkey-over-net.patch, #32464
        StatusNone Need Info
        Assigned toNone arvidjaar
        Open/ClosedOpen Analyzed
    2014-11-18 rkliewer Attached File- Added verify.c.patch, #32459
    2014-11-17 rkliewer Attached File- Added file.c.patch, #32455
    2014-11-17 rkliewer Attached File- Added screencap.png, #32454

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code