From 504206a0eb85a4064edb2c3b401f50de54f9fe2d Mon Sep 17 00:00:00 2001 From: Qiumiao Zhang Date: Mon, 23 Dec 2024 10:12:07 +0000 Subject: [PATCH] fix not verifying grub.cfg when loading it Signed-off-by: Qiumiao Zhang (cherry picked from commit 3eda58b0c237aec4f718f337d67fcb102aed3d44) --- ...t-verifying-grub-cfg-when-loading-it.patch | 36 +++++++++++++++++++ grub.patches | 1 + grub2.spec | 8 ++++- 3 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch diff --git a/bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch b/bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch new file mode 100644 index 0000000..269b471 --- /dev/null +++ b/bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch @@ -0,0 +1,36 @@ +From 7d26233eb454d75419476eb9d1729ea3b2972238 Mon Sep 17 00:00:00 2001 +From: Qiumiao Zhang +Date: Wed, 18 Dec 2024 09:26:33 +0000 +Subject: [PATCH] fix not verifying grub.cfg when loading it + +Fixes: c8b6446348a4 ("skip verification when not loading grub.cfg") +Signed-off-by: Qiumiao Zhang +--- + grub-core/normal/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c +index f3e14bf..06d91c0 100644 +--- a/grub-core/normal/main.c ++++ b/grub-core/normal/main.c +@@ -134,7 +134,7 @@ read_config_file (const char *config) + } + + /* Try to open the config file. */ +- rawfile = grub_file_open (config, GRUB_FILE_TYPE_SKIP_SIGNATURE); ++ rawfile = grub_file_open (config, GRUB_FILE_TYPE_CONFIG); + if (! rawfile) + return 0; + +@@ -373,7 +373,7 @@ grub_try_normal (const char *variable) + if (config) + { + grub_file_t file; +- file = grub_file_open (config, GRUB_FILE_TYPE_CONFIG); ++ file = grub_file_open (config, GRUB_FILE_TYPE_SKIP_SIGNATURE); + if (file) + { + grub_file_close (file); +-- +2.33.0 + diff --git a/grub.patches b/grub.patches index 0aa9a69..14f82b4 100644 --- a/grub.patches +++ b/grub.patches @@ -245,3 +245,4 @@ Patch245: 0002-efi-Add-API-for-retrieving-the-EFI-secret-for-crypto.patch Patch246: backport-acpi-Fix-out-of-bounds-access-in-grub_acpi_xsdt_find.patch Patch247: backport-commands-efi-tpm-Re-enable-measurements-on-confident.patch Patch248: backport-commands-legacycfg-Avoid-closing-file-twice.patch +Patch249: bugfix-fix-not-verifying-grub-cfg-when-loading-it.patch diff --git a/grub2.spec b/grub2.spec index 231bc16..1ba12aa 100644 --- a/grub2.spec +++ b/grub2.spec @@ -19,7 +19,7 @@ Name: grub2 Epoch: 1 Version: 2.12 -Release: 30 +Release: 31 Summary: Bootloader with support for Linux, Multiboot and more License: GPLv3+ URL: http://www.gnu.org/software/grub/ @@ -461,6 +461,12 @@ fi %{_datadir}/man/man* %changelog +* Mon Dec 23 2024 zhangqiumiao - 1:2.12-31 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:fix not verifying grub.cfg when loading it + * Sat Dec 21 2024 zhangqiumiao - 1:2.12-30 - Type:bugfix - CVE:NA -- Gitee