mirror of
https://git.yoctoproject.org/poky
synced 2026-09-19 18:49:32 +02:00
9a88c1d255
CVE-2015-8370 grub2: buffer overflow when checking password entered during bootup (From OE-Core rev: b63e3b57b47e95003a1fb014f90333c327681d5b) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
60 lines
1.5 KiB
Diff
60 lines
1.5 KiB
Diff
From 451d80e52d851432e109771bb8febafca7a5f1f2 Mon Sep 17 00:00:00 2001
|
|
From: Hector Marco-Gisbert <hecmargi@upv.es>
|
|
Date: Wed, 16 Dec 2015 07:57:18 +0300
|
|
Subject: [PATCH] Fix security issue when reading username and password
|
|
|
|
This patch fixes two integer underflows at:
|
|
* grub-core/lib/crypto.c
|
|
* grub-core/normal/auth.c
|
|
|
|
CVE-2015-8370
|
|
|
|
Signed-off-by: Hector Marco-Gisbert <hecmargi@upv.es>
|
|
Signed-off-by: Ismael Ripoll-Ripoll <iripoll@disca.upv.es>
|
|
Also-By: Andrey Borzenkov <arvidjaar@gmail.com>
|
|
|
|
Upstream-Status: Backport
|
|
|
|
http://git.savannah.gnu.org/cgit/grub.git/commit/?id=451d80e52d851432e109771bb8febafca7a5f1f2
|
|
|
|
CVE: CVE-2015-8370
|
|
Signed-off-by: Armin Kuster <akuster@mvista.com>
|
|
|
|
---
|
|
grub-core/lib/crypto.c | 3 ++-
|
|
grub-core/normal/auth.c | 7 +++++--
|
|
2 files changed, 7 insertions(+), 3 deletions(-)
|
|
|
|
Index: git/grub-core/lib/crypto.c
|
|
===================================================================
|
|
--- git.orig/grub-core/lib/crypto.c
|
|
+++ git/grub-core/lib/crypto.c
|
|
@@ -458,7 +458,8 @@ grub_password_get (char buf[], unsigned
|
|
|
|
if (key == '\b')
|
|
{
|
|
- cur_len--;
|
|
+ if (cur_len)
|
|
+ cur_len--;
|
|
continue;
|
|
}
|
|
|
|
Index: git/grub-core/normal/auth.c
|
|
===================================================================
|
|
--- git.orig/grub-core/normal/auth.c
|
|
+++ git/grub-core/normal/auth.c
|
|
@@ -174,8 +174,11 @@ grub_username_get (char buf[], unsigned
|
|
|
|
if (key == '\b')
|
|
{
|
|
- cur_len--;
|
|
- grub_printf ("\b");
|
|
+ if (cur_len)
|
|
+ {
|
|
+ cur_len--;
|
|
+ grub_printf ("\b");
|
|
+ }
|
|
continue;
|
|
}
|
|
|