From c87d2e3edbc8dc725aa2c75fe6fcb8a51fc5c846 Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Fri, 31 May 2024 15:14:57 +0800 Subject: [PATCH] fs/xfs: Fix out-of-bounds read The number of records in the root key array read from disk was not being validated against the size of the root node. This could lead to an out-of-bounds read. This patch adds a check to ensure that the number of records in the root key array does not exceed the expected size of a root node read from disk. If this check detects an out-of-bounds condition the operation is aborted to prevent random errors due to metadata corruption. Reported-by: Daniel Axtens Signed-off-by: Michael Chang Reviewed-by: Daniel Kiper Gbp-Pq: Topic cve-2025-jan Gbp-Pq: Name fs-xfs-Fix-out-of-bounds-read.patch --- grub-core/fs/xfs.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c index bc2224d..d2d5335 100644 --- a/grub-core/fs/xfs.c +++ b/grub-core/fs/xfs.c @@ -595,6 +595,17 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) do { grub_uint64_t i; + grub_addr_t keys_end, data_end; + + if (grub_mul (sizeof (grub_uint64_t), nrec, &keys_end) || + grub_add ((grub_addr_t) keys, keys_end, &keys_end) || + grub_add ((grub_addr_t) node->data, node->data->data_size, &data_end) || + keys_end > data_end) + { + grub_error (GRUB_ERR_BAD_FS, "invalid number of XFS root keys"); + grub_free (leaf); + return 0; + } for (i = 0; i < nrec; i++) { -- 2.30.2