bugGNU GRUB - Bugs: bug #60458, grub 2.06 reboots immediately when...


You are not allowed to post comments on this tracker with your current authentication level.

bug #60458: grub 2.06 reboots immediately when compiled with -O2 (bisected)

Submitter:  Tony Battersby <cybertony>
Submitted:  Mon 26 Apr 2021 06:38:14 PM UTC
Category:  Booting Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  * Git master
Release:  Reproducibility:  Every Time
Planned Release:  None
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:


Mon 26 Apr 2021 06:38:14 PM UTC, original submission:  

When grub-2.06-rc1 is compiled with -O2 instead of the default -Os, it reboots immediately instead of showing the menu, leading to an endless reboot loop.  I am using x86-64 legacy BIOS mode (no EFI) on a variety of motherboards and CPUs.  I have bisected the problem down to the following commit:

commit 4ea7bae51f97e49c84dc67ea30b466ca8633b9f6
Author: Chris Coulson <chris.coulson@canonical.com>
Date:   Thu Jan 7 19:21:03 2021 +0000

    kern/parser: Fix a stack buffer overflow


    grub_parser_split_cmdline() expands variable names present in the supplied
    command line in to their corresponding variable contents and uses a 1 kiB
    stack buffer for temporary storage without sufficient bounds checking. If
    the function is called with a command line that references a variable with
    a sufficiently large payload, it is possible to overflow the stack
    buffer via tab completion, corrupt the stack frame and potentially
    control execution.


    Fixes: CVE-2020-27749


    Reported-by: Chris Coulson <chris.coulson@canonical.com>
    Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
    Signed-off-by: Darren Kenny <darren.kenny@oracle.com>
    Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

Reverting that commit fixes the problem.

I noticed this problem after upgrading to the just-released Yocto 3.3 Hardknott.  Yocto has "-O2" in the default CFLAGS, which is how I encountered this problem (I don't actually care about the grub optimization level).  I verified that the same problem exists if I compile grub 2.06-rc1 on Ubuntu 20.04 with CFLAGS="-O2" outside of Yocto.  Although I can fix the problem by telling Yocto to use -Os instead of -O2, I figured that this issue might point to a bug in the code that is worth reporting and fixing.

Yocto 3.3 has gcc 10.2
Ubuntu 20.04 has gcc 9.3

Tony Battersby <cybertony>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by cybertony (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    No changes have been made to this item

    Back to the top

    Powered by Savane 3.9