1From 7630ec5397fe418276b360f9011934b8c034936c Mon Sep 17 00:00:00 2001
2From: Javier Martinez Canillas <javierm@redhat.com>
3Date: Tue, 29 Sep 2020 14:08:55 +0200
4Subject: [PATCH] dl: Only allow unloading modules that are not dependencies
5
6When a module is attempted to be removed its reference counter is always
7decremented. This means that repeated rmmod invocations will cause the
8module to be unloaded even if another module depends on it.
9
10This may lead to a use-after-free scenario allowing an attacker to execute
11arbitrary code and by-pass the UEFI Secure Boot protection.
12
13While being there, add the extern keyword to some function declarations in
14that header file.
15
16Fixes: CVE-2020-25632
17
18Reported-by: Chris Coulson <chris.coulson@canonical.com>
19Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
20Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
21Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
22---
23 grub-core/commands/minicmd.c | 7 +++++--
24 grub-core/kern/dl.c          | 9 +++++++++
25 include/grub/dl.h            | 8 +++++---
26 3 files changed, 19 insertions(+), 5 deletions(-)
27
28diff --git a/grub-core/commands/minicmd.c b/grub-core/commands/minicmd.c
29index 6bbce31..fa49893 100644
30--- a/grub-core/commands/minicmd.c
31+++ b/grub-core/commands/minicmd.c
32@@ -140,8 +140,11 @@ grub_mini_cmd_rmmod (struct grub_command *cmd __attribute__ ((unused)),
33   if (grub_dl_is_persistent (mod))
34     return grub_error (GRUB_ERR_BAD_ARGUMENT, "cannot unload persistent module");
35
36-  if (grub_dl_unref (mod) <= 0)
37-    grub_dl_unload (mod);
38+  if (grub_dl_ref_count (mod) > 1)
39+    return grub_error (GRUB_ERR_BAD_ARGUMENT, "cannot unload referenced module");
40+
41+  grub_dl_unref (mod);
42+  grub_dl_unload (mod);
43
44   return 0;
45 }
46diff --git a/grub-core/kern/dl.c b/grub-core/kern/dl.c
47index 48eb5e7..48f8a79 100644
48--- a/grub-core/kern/dl.c
49+++ b/grub-core/kern/dl.c
50@@ -549,6 +549,15 @@ grub_dl_unref (grub_dl_t mod)
51   return --mod->ref_count;
52 }
53
54+int
55+grub_dl_ref_count (grub_dl_t mod)
56+{
57+  if (mod == NULL)
58+    return 0;
59+
60+  return mod->ref_count;
61+}
62+
63 static void
64 grub_dl_flush_cache (grub_dl_t mod)
65 {
66diff --git a/include/grub/dl.h b/include/grub/dl.h
67index f03c035..b3753c9 100644
68--- a/include/grub/dl.h
69+++ b/include/grub/dl.h
70@@ -203,9 +203,11 @@ grub_dl_t EXPORT_FUNC(grub_dl_load) (const char *name);
71 grub_dl_t grub_dl_load_core (void *addr, grub_size_t size);
72 grub_dl_t EXPORT_FUNC(grub_dl_load_core_noinit) (void *addr, grub_size_t size);
73 int EXPORT_FUNC(grub_dl_unload) (grub_dl_t mod);
74-void grub_dl_unload_unneeded (void);
75-int EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod);
76-int EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod);
77+extern void grub_dl_unload_unneeded (void);
78+extern int EXPORT_FUNC(grub_dl_ref) (grub_dl_t mod);
79+extern int EXPORT_FUNC(grub_dl_unref) (grub_dl_t mod);
80+extern int EXPORT_FUNC(grub_dl_ref_count) (grub_dl_t mod);
81+
82 extern grub_dl_t EXPORT_VAR(grub_dl_head);
83
84 #ifndef GRUB_UTIL
85--
862.14.2
87
88