From 8368c026562a72a005bea320cfde9fd7d62d3850 Mon Sep 17 00:00:00 2001 From: Alec Brown Date: Thu, 21 Aug 2025 21:14:07 +0000 Subject: [PATCH 4/4] normal/main: Unregister commands on module unload When the normal module is loaded, the normal and normal_exit commands are registered but aren't unregistered when the module is unloaded. We need to add calls to grub_unregister_command() when unloading the module for these commands. Fixes: CVE-2025-61663 Fixes: CVE-2025-61664 CVE: CVE-2025-61663 CVE-2025-61664 Upstream-Status: Backport [https://gitweb.git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=05d3698b8b03eccc49e53491bbd75dba15f40917] Reported-by: Alec Brown Signed-off-by: Alec Brown Reviewed-by: Daniel Kiper Signed-off-by: Jiaying Song --- grub-core/normal/main.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c index dad25e7d2..a810858c3 100644 --- a/grub-core/normal/main.c +++ b/grub-core/normal/main.c @@ -500,7 +500,7 @@ grub_mini_cmd_clear (struct grub_command *cmd __attribute__ ((unused)), return 0; } -static grub_command_t cmd_clear; +static grub_command_t cmd_clear, cmd_normal, cmd_normal_exit; static void (*grub_xputs_saved) (const char *str); static const char *features[] = { @@ -542,10 +542,10 @@ GRUB_MOD_INIT(normal) grub_env_export ("pager"); /* Register a command "normal" for the rescue mode. */ - grub_register_command ("normal", grub_cmd_normal, - 0, N_("Enter normal mode.")); - grub_register_command ("normal_exit", grub_cmd_normal_exit, - 0, N_("Exit from normal mode.")); + cmd_normal = grub_register_command ("normal", grub_cmd_normal, + 0, N_("Enter normal mode.")); + cmd_normal_exit = grub_register_command ("normal_exit", grub_cmd_normal_exit, + 0, N_("Exit from normal mode.")); /* Reload terminal colors when these variables are written to. */ grub_register_variable_hook ("color_normal", NULL, grub_env_write_color_normal); @@ -587,4 +587,6 @@ GRUB_MOD_FINI(normal) grub_register_variable_hook ("color_highlight", NULL, NULL); grub_fs_autoload_hook = 0; grub_unregister_command (cmd_clear); + grub_unregister_command (cmd_normal); + grub_unregister_command (cmd_normal_exit); } -- 2.34.1