diff --git a/backport-commands-legacycfg-Avoid-closing-file-twice.patch b/backport-commands-legacycfg-Avoid-closing-file-twice.patch new file mode 100644 index 0000000000000000000000000000000000000000..d5cb52b146bc244924bb5f05f68de78d925b5f86 --- /dev/null +++ b/backport-commands-legacycfg-Avoid-closing-file-twice.patch @@ -0,0 +1,40 @@ +From f26b39860d32e2b9edb30370349e40b1ac7055c8 Mon Sep 17 00:00:00 2001 +From: Leo Sandoval +Date: Wed, 16 Oct 2024 11:54:38 -0600 +Subject: [PATCH] commands/legacycfg: Avoid closing file twice + +An internal (at Red Hat) static soure code scan detected an +use-after-free scenario: + + Error: USE_AFTER_FREE (CWE-416): + grub-2.06/grub-core/commands/legacycfg.c:194: freed_arg: "grub_file_close" frees "file". + grub-2.06/grub-core/commands/legacycfg.c:201: deref_arg: Calling "grub_file_close" dereferences freed pointer "file". + # 199| if (!args) + # 200| { + # 201|-> grub_file_close (file); + # 202| grub_free (suffix); + # 203| grub_free (entrysrc); + +So, remove the extra file close call. + +Signed-off-by: Leo Sandoval +Reviewed-by: Daniel Kiper +--- + grub-core/commands/legacycfg.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/grub-core/commands/legacycfg.c b/grub-core/commands/legacycfg.c +index e9e9d94ef..3bf9fe2e4 100644 +--- a/grub-core/commands/legacycfg.c ++++ b/grub-core/commands/legacycfg.c +@@ -198,7 +198,6 @@ legacy_file (const char *filename) + const char **args = grub_malloc (sizeof (args[0])); + if (!args) + { +- grub_file_close (file); + grub_free (suffix); + grub_free (entrysrc); + return grub_errno; +-- +2.33.0 + diff --git a/grub.patches b/grub.patches index b7c08b1c1b2f7c3c191fddd89ef208890343f902..0aa9a69ad3fcaef8070a98eb44e5734713d72d28 100644 --- a/grub.patches +++ b/grub.patches @@ -244,3 +244,4 @@ Patch244: 0001-cryptodisk-add-OS-provided-secret-support.patch Patch245: 0002-efi-Add-API-for-retrieving-the-EFI-secret-for-crypto.patch Patch246: backport-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch Patch247: backport-commands-efi-tpm-Re-enable-measurements-on-confident.patch +Patch248: backport-commands-legacycfg-Avoid-closing-file-twice.patch diff --git a/grub2.spec b/grub2.spec index 2bf9696c172d03fc9b8fbb2c5a0ab43e8633b80b..231bc161bc60a5f48b52538b2e7589ce78312327 100644 --- a/grub2.spec +++ b/grub2.spec @@ -19,7 +19,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 29 +Release: 30 Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -461,6 +461,12 @@ fi %{_datadir}/man/man* %changelog +* Sat Dec 21 2024 zhangqiumiao - 1:2.12-30 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:commands/legacycfg: Avoid closing file twice + * Fri Dec 13 2024 Ouuleilei - 1:2.12-29 - revert sohpgo's modify-efi_max_usable-addr.patch