bugGNU GRUB - Bugs: bug #66599, GRUB2 heap overflow when parsing...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #66599: GRUB2 heap overflow when parsing HFS filesystems

Submitter:  Jonathan Bar Or ("JBO") <yo_yo_yo_jbo>
Submitted:  Thu 26 Dec 2024 05:13:22 PM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  2.00
Release:  Reproducibility:  None
Planned Release:  None

Thu 26 Dec 2024 05:13:22 PM UTC, original submission:  

GRUB2 has an out-of-bounds strcpy (heap overflow) when parsing HFS filesystems.
In grub-core/fs/hfs.c, there is an assumption that the volume name is a valid Pascal string, and hence simply performing the following:

key.strlen = data->sblock.volname[0];
grub_strcpy ((char ) key.str, (char ) (data->sblock.volname + 1));

key is of type "struct grub_hfs_catalog_key" and its "str" member is defined as: grub_uint8_t[31]

The "sblock" member in the data is fully attacker-controlled, since its type is "grub_hfs_sblock" and all members after "volname" can be set to arbitrary values, hence avoiding NUL terminators.

Jonathan Bar Or ("JBO") <yo_yo_yo_jbo>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yo_yo_yo_jbo (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.14-9aa3.
    Corresponding source code