GNU GRUB - Bugs: bug #43601, Built-in gpg verification fails...
You are not allowed to post comments on this tracker with your current authentication level.
bug #43601: Built-in gpg verification fails over tftp
Submitter: | Rob <rkliewer> | ||
Submitted: | Thu 13 Nov 2014 03:53:48 PM UTC | ||
Category: | Security | Severity: | Major |
Priority: | 5 - Normal | Item Group: | Software Error |
Status: | Fixed | Privacy: | Public |
Assigned to: | arvidjaar | Originator Name: | |
Open/Closed: | Closed | Release: | Git master |
Release: | Reproducibility: | Every Time | |
Planned Release: | None |
Fri 05 Dec 2014 06:22:25 PM UTC, comment #5: |
Andrei Borzenkov <arvidjaar> |
Tue 18 Nov 2014 09:02:14 PM UTC, comment #4: Looks good. I was able to fully boot with check_signatures on using tftp and http in both a legacy pxe build and an x86_64-efi build. Thanks for your help. |
Rob <rkliewer> |
Tue 18 Nov 2014 07:16:45 PM UTC, comment #3: Thank you for tracing it down but your fix means memory leak. Please test attached patch which makes grub_pubkey_open to behave like other filter drivers. Commit message explains it in details. |
Andrei Borzenkov <arvidjaar> |
Tue 18 Nov 2014 03:36:19 PM UTC, comment #2: I believe I found the source of the issue. When the device is a net device, grub_pubkey_open in verify.c closes the net device at the end with the grub_file_close(io) call even though that is not the intent (io->device is nulled before the free call, but the call back into grub_net_fs_close closes the device anyway). When the function doing the original file operation (cat in my case) does it's close, the device is double freed and causes the memory corruption error. I've attached a patch that skips the grub_file_close(io) step in grub_pubkey_open if the device is a net device. This has fixed my issue without any adverse consequences. |
Rob <rkliewer> |
Mon 17 Nov 2014 06:19:33 PM UTC, comment #1: The problem seems to originate during file closure. I added debug logging to grub_file_close, logging messages before the fs close, device close, and file free. I've attached a screenshot of the failure; at first I cat extbootopt without check_signatures set and then cat again with check_signatures set. The device close seems to be the origin of the failure. |
Rob <rkliewer> |
Thu 13 Nov 2014 03:53:48 PM UTC, original submission:
I am booting an x86_64 efi image over tftp on a vmware 10 instance. I'm seeing an issue in both grub 2.02~beta2 and the latest git when using a gpg public key with check_signatures enabled. All file operations over tftp (or http) complete, but grub immediately throws the following error:
|
Rob <rkliewer> |
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2014-12-05 | arvidjaar | Status | Need Info | Fixed | |
Open/Closed | Analyzed | Closed | |||
2014-11-18 | arvidjaar | Attached File | - | Added fix-use-after-free-in-pubkey-over-net.patch, #32464 | |
Status | None | Need Info | |||
Assigned to | None | arvidjaar | |||
Open/Closed | Open | Analyzed | |||
2014-11-18 | rkliewer | Attached File | - | Added verify.c.patch, #32459 | |
2014-11-17 | rkliewer | Attached File | - | Added file.c.patch, #32455 | |
2014-11-17 | rkliewer | Attached File | - | Added screencap.png, #32454 |
Powered by Savane 3.13-02a9.
Corresponding source code
Fixed in ebb3d958aa2e1af8993c77018436bb14bec600b4. Thank you for testing.