bugGNU GRUB - Bugs: bug #43601, Built-in gpg verification fails...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #43601: Built-in gpg verification fails over tftp

Submitted by:  Rob <rkliewer>
Submitted on:  Thu 13 Nov 2014 03:53:48 PM UTC  
 
Category: SecuritySeverity: Major
Priority: 5 - NormalItem Group: Software Error
Status: FixedPrivacy: Public
Assigned to: Andrei Borzenkov <arvidjaar>Originator Name: 
Open/Closed: ClosedRelease: 
Release: Git masterReproducibility: Every Time
Planned Release: None

Fri 05 Dec 2014 06:22:25 PM UTC, comment #5:

Fixed in ebb3d958aa2e1af8993c77018436bb14bec600b4. Thank you for testing.

Andrei Borzenkov <arvidjaar>
Project MemberIn charge of this item.
Tue 18 Nov 2014 09:02:14 PM UTC, comment #4:

Looks good. I was able to fully boot with check_signatures on using tftp and http in both a legacy pxe build and an x86_64-efi build. Thanks for your help.

Rob <rkliewer>
Tue 18 Nov 2014 07:16:45 PM UTC, comment #3:

Thank you for tracing it down but your fix means memory leak. Please test attached patch which makes grub_pubkey_open to behave like other filter drivers. Commit message explains it in details.

(file #32464)

Andrei Borzenkov <arvidjaar>
Project MemberIn charge of this item.
Tue 18 Nov 2014 03:36:19 PM UTC, comment #2:

I believe I found the source of the issue. When the device is a net device, grub_pubkey_open in verify.c closes the net device at the end with the grub_file_close(io) call even though that is not the intent (io->device is nulled before the free call, but the call back into grub_net_fs_close closes the device anyway). When the function doing the original file operation (cat in my case) does it's close, the device is double freed and causes the memory corruption error. I've attached a patch that skips the grub_file_close(io) step in grub_pubkey_open if the device is a net device. This has fixed my issue without any adverse consequences.

(file #32459)

Rob <rkliewer>
Mon 17 Nov 2014 06:19:33 PM UTC, comment #1:

The problem seems to originate during file closure. I added debug logging to grub_file_close, logging messages before the fs close, device close, and file free. I've attached a screenshot of the failure; at first I cat extbootopt without check_signatures set and then cat again with check_signatures set. The device close seems to be the origin of the failure.

Rob <rkliewer>
Thu 13 Nov 2014 03:53:48 PM UTC, original submission:

I am booting an x86_64 efi image over tftp on a vmware 10 instance. I'm seeing an issue in both grub 2.02~beta2 and the latest git when using a gpg public key with check_signatures enabled. All file operations over tftp (or http) complete, but grub immediately throws the following error:

alloc magic is broken at <addr>: <value> Aborted.
Press any key to exit.

Pressing a key takes me back to the EFI firmware. I can work around the issue by disabling check signatures and manually running verify_detached on a file, but that leaves me having to pull the kernel and initrd twice and nearly double my boot time. Signature checking from a memdisk does not appear to be broken.

Rob <rkliewer>

 

Attached Files
file #32459:  verify.c.patch added by rkliewer (409B - application/octet-stream)
file #32455:  file.c.patch added by rkliewer (571B - application/octet-stream)
file #32454:  screencap.png added by rkliewer (15KiB - image/png)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by arvidjaar (Updated the item)
  • -unavailable- added by rkliewer (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 05 Dec 2014 06:22:25 PM UTCarvidjaarStatusNeed Info=>Fixed
      Open/ClosedAnalyzed=>Closed
    Tue 18 Nov 2014 07:16:45 PM UTCarvidjaarAttached File-=>Added fix-use-after-free-in-pubkey-over-net.patch, #32464
      StatusNone=>Need Info
      Assigned toNone=>arvidjaar
      Open/ClosedOpen=>Analyzed
    Tue 18 Nov 2014 03:36:19 PM UTCrkliewerAttached File-=>Added verify.c.patch, #32459
    Mon 17 Nov 2014 08:49:05 PM UTCrkliewerAttached File-=>Added file.c.patch, #32455
    Mon 17 Nov 2014 06:14:30 PM UTCrkliewerAttached File-=>Added screencap.png, #32454

    Back to the top


    Powered by Savane 3.1-cleanup1