packages/grub2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix CVE-2024-56738

Browse Source 
Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
(cherry picked from commit 52ed96a0e9538a6af7618df42993dde9e683048d)
This commit is contained in:
Qiumiao Zhang 2025-04-08 01:57:45 +00:00 committed by openeuler-sync-bot
parent 39986b5c02
commit 53de2e4295
3 changed files with 50 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
backport-fix-CVE-2024-56738.patch Normal file
View File

@ -0,0 +1,42 @@
From 8b1b47efd667ea3450681fa0c674045980e25360 Mon Sep 17 00:00:00 2001
From: Jonathan Bar Or <jonathanbaror@gmail.com>
Date: Mon, 7 Apr 2025 09:36:34 +0000
Subject: [PATCH] fix CVE-2024-56738
Reference:https://savannah.gnu.org/bugs/?66603
Conflict:NA
---
grub-core/lib/crypto.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
index d53ddbe..653aab7 100644
--- a/grub-core/lib/crypto.c
+++ b/grub-core/lib/crypto.c
@@ -440,16 +440,16 @@ grub_crypto_gcry_error (gcry_err_code_t in)
int
grub_crypto_memcmp (const void *a, const void *b, grub_size_t n)
{
- register grub_size_t counter = 0;
- const grub_uint8_t *pa, *pb;
+ register grub_uint8_t indicator = 0;
+ const grub_uint8_t *pa = a, *pb = b;
+ grub_size_t i;
- for (pa = a, pb = b; n; pa++, pb++, n--)
+ for (i = 0; i < n; i++)
{
- if (*pa != *pb)
- counter++;
+ indicator |= (pa[i] ^ pb[i]);
}
- return !!counter;
+ return !!indicator;
}
#ifndef GRUB_UTIL
--
2.33.0

2
grub.patches
View File

@ -440,4 +440,4 @@ Patch0439: backport-0079-kern-partition-Add-sanity-check-after-grub_strtoul-c.pa
Patch0440: backport-0080-kern-misc-Add-sanity-check-after-grub_strtoul-call.patch
Patch0441: backport-0081-loader-i386-linux-Cast-left-shift-to-grub_uint32_t.patch
Patch0442: backport-0082-loader-i386-bsd-Use-safe-math-to-avoid-underflow.patch
Patch0443: backport-fix-CVE-2024-56738.patch

8
grub2.spec
View File

@ -14,7 +14,7 @@
Name: grub2
Epoch: 1
Version: 2.06
Release: 51
Release: 52
Summary: Bootloader with support for Linux, Multiboot and more
License: GPLv3+
URL: http://www.gnu.org/software/grub/
@ -453,6 +453,12 @@ fi
%{_datadir}/man/man*
%changelog
* Tue Apr 8 2025 zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.06-52
- Type:CVE
- CVE:CVE-2024-56738
- SUG:NA
- DESC:fix CVE-2024-56738
* Tue Feb 25 2025 sunhai <sunhai10@huawei.com> - 1:2.06-51
- Type:CVE
- CVE:CVE-2024-45781,CVE-2024-45782,CVE-2024-56737,CVE-2024-45780,CVE-2024-45783,CVE-2024-49504,CVE-2025-0624,CVE-20