bugGNU GRUB - Bugs: bug #60458, grub 2.06 reboots immediately when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60458: grub 2.06 reboots immediately when compiled with -O2 (bisected)

Submitter:  Tony Battersby <cybertony>
Submitted:  Mon 26 Apr 2021 06:38:14 PM UTC
   
 
Category:  Booting Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  Git master
Release:  Reproducibility:  Every Time
Planned Release:  None

Mon 26 Apr 2021 06:38:14 PM UTC, original submission:  

When grub-2.06-rc1 is compiled with -O2 instead of the default -Os, it reboots immediately instead of showing the menu, leading to an endless reboot loop.  I am using x86-64 legacy BIOS mode (no EFI) on a variety of motherboards and CPUs.  I have bisected the problem down to the following commit:

commit 4ea7bae51f97e49c84dc67ea30b466ca8633b9f6
Author: Chris Coulson <chris.coulson@canonical.com>
Date:   Thu Jan 7 19:21:03 2021 +0000

    kern/parser: Fix a stack buffer overflow
   
    grub_parser_split_cmdline() expands variable names present in the supplied
    command line in to their corresponding variable contents and uses a 1 kiB
    stack buffer for temporary storage without sufficient bounds checking. If
    the function is called with a command line that references a variable with
    a sufficiently large payload, it is possible to overflow the stack
    buffer via tab completion, corrupt the stack frame and potentially
    control execution.
   
    Fixes: CVE-2020-27749
   
    Reported-by: Chris Coulson <chris.coulson@canonical.com>
    Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
    Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
    Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

Reverting that commit fixes the problem.

I noticed this problem after upgrading to the just-released Yocto 3.3 Hardknott.  Yocto has "-O2" in the default CFLAGS, which is how I encountered this problem (I don't actually care about the grub optimization level).  I verified that the same problem exists if I compile grub 2.06-rc1 on Ubuntu 20.04 with CFLAGS="-O2" outside of Yocto.  Although I can fix the problem by telling Yocto to use -Os instead of -O2, I figured that this issue might point to a bug in the code that is worth reporting and fixing.

Yocto 3.3 has gcc 10.2
Ubuntu 20.04 has gcc 9.3

Tony Battersby <cybertony>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by cybertony (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code