bugGNU GRUB - Bugs: bug #65880, heap-buffer-overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65880: heap-buffer-overflow in grub-mkrescue.c

Submitter:  Victoriia Egorova <vegorova>
Submitted:  Fri 14 Jun 2024 11:13:08 AM UTC
   
 
Category:  None Severity:  Major
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  other
Release:  Reproducibility:  Every Time
Planned Release:  None

Mon 01 Jul 2024 09:58:56 AM UTC, comment #4: 

Hi,

belatedly i can report that the proposed change was committed to the
git repo of GRUB as
  https://git.savannah.gnu.org/cgit/grub.git/commit/?id=b53ec06a1d6f22ffc1139cbfc0f292e4ca2da9cd

I propose to close the bug now.

Have a nice day :)

Thomas

Thomas Schmitt <scdbackup>
Mon 17 Jun 2024 07:21:35 PM UTC, comment #3: 

Hi,

the patch is now posted for review and testing at grub-devel:
  https://lists.gnu.org/archive/html/grub-devel/2024-06/msg00163.html

Have a nice day :)

Thomas

Thomas Schmitt <scdbackup>
Mon 17 Jun 2024 12:30:07 PM UTC, comment #2: 

Thomas, savannah just butchers the patch. Can you send it to ML?

 Vladimir Serbinenko <phcoder>
Group administrator
Fri 14 Jun 2024 12:56:16 PM UTC, comment #1: 

Hi,

i can confirm that it happens on Debian 12 with the Debian amd64 package
grub-common (2.06-13+deb12u1) (plus grub-efi-amd64 , grub-efi-amd64-bin ,
grub-efi-amd64-signed , grub2-common) and also with a git clone of today.

The change at the end of this comment fixes the problem for me (and
mimicks the error message of Debian 8 which does not show the problem).

Debian-8 binary:
  grub-mkrescue: option requires an argument -- 'k'
  Try 'grub-mkrescue --help' or 'grub-mkrescue --usage' for more information.

Changed git clone:
  $ ./grub-mkrescue -k
  ./grub-mkrescue: error: option requires an argument -- '-k'.
  $ echo $?
  1

Please try whether the change works for you, too.

Have a nice day :)

Thomas

--------------------------------------------------------------------------

--- util/grub-mkrescue.c.orig   2024-06-14 14:34:18.109255492 +0200
+++ util/grub-mkrescue.c        2024-06-14 14:37:18.052729569 +0200
@@ -477,6 +477,9 @@ main (int argc, char *argv[])
     for (i = 1; i < argc; i++)
       {
        if (strcmp (argv[i], "-output") == 0) {
+         if (i + 1 >= argc)
+           grub_util_error ("%s -- '%s'", _("option requires an argument"),
+                            argv[i]);
          argp_argv[argp_argc++] = (char *) "--output";
          i++;
          argp_argv[argp_argc++] = argv[i];
@@ -485,6 +488,9 @@ main (int argc, char *argv[])
        switch (args_to_eat (argv[i]))
          {
          case 2:
+           if (i + 1 >= argc)
+             grub_util_error ("%s -- '%s'", _("option requires an argument"),
+                              argv[i]);
            argp_argv[argp_argc++] = argv[i++];
            /* Fallthrough  */
          case 1:

Thomas Schmitt <scdbackup>
Fri 14 Jun 2024 11:13:08 AM UTC, original submission:  

Steps to reproduce:
build grub2 (i tried v2.06, but this code part seems almost the same in v.2.12) with ASAN
run grub-mkrescue with -k or -d opt without additional args:
./grub-mkrescue -k
or
./grub-mkrescue -d

It looks like we're looking for the arg after these flags (-k and -d), but if we don't have it we also haven't allocated enough memory for argp_argv (we allocated it only for argc elements, in this case there are only two of them), but trying to write here in line
argp_argv[argp_argc++] = argv[i];
so it causes a heap-buffer-overflow.


Backtrace:
=================================================================
==264950==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000380 at pc 0x5e64d4e5f556 bp 0x7fff53f3ba30 sp 0x7fff53f3ba28
WRITE of size 8 at 0x602000000380 thread T0
    #0 0x5e64d4e5f555 in main ../../util/grub-mkrescue.c:471
    #1 0x7cc0f5e04249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #2 0x7cc0f5e04304 in __libc_start_main_impl ../csu/libc-start.c:360
    #3 0x5e64d4e61a20 in _start (/app/grub/grub2/grub2-2.06/obj/grub-pc/grub-mkrescue+0x4ea20)

0x602000000380 is located 0 bytes to the right of 16-byte region [0x602000000370,0x602000000380)
allocated by thread T0 here:
    #0 0x7cc0f61553b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
    #1 0x5e64d4ff5275 in xcalloc ../../grub-core/kern/emu/misc.c:93

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../util/grub-mkrescue.c:471 in main
Shadow bytes around the buggy address:
  0x0c047fff8020: fa fa fd fa fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff8030: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff8040: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x0c047fff8050: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 05 fa
  0x0c047fff8060: fa fa 05 fa fa fa 00 fa fa fa fd fd fa fa 00 00
=>0x0c047fff8070:[fa]fa 00 00 fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==264950==ABORTING

Victoriia Egorova <vegorova>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by phcoder (Posted a comment)
  • -email is unavailable- added by scdbackup (Posted a comment)
  • -email is unavailable- added by vegorova (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-72d9.
    Corresponding source code