From 839c0dca85cdbd147a27ea4987370bbf15300c2d Mon Sep 17 00:00:00 2001 From: Michael Chang Date: Fri, 31 May 2024 15:14:57 +0800 Subject: [PATCH] fs/xfs: Fix out-of-bounds read The number of records in the root key array read from disk was not being validated against the size of the root node. This could lead to an out-of-bounds read. This patch adds a check to ensure that the number of records in the root key array does not exceed the expected size of a root node read from disk. If this check detects an out-of-bounds condition the operation is aborted to prevent random errors due to metadata corruption. Reported-by: Daniel Axtens Signed-off-by: Michael Chang Reviewed-by: Daniel Kiper Gbp-Pq: Topic cve-2025-jan Gbp-Pq: Name fs-xfs-Fix-out-of-bounds-read.patch --- grub-core/fs/xfs.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/grub-core/fs/xfs.c b/grub-core/fs/xfs.c index bc2224d..d2d5335 100644 --- a/grub-core/fs/xfs.c +++ b/grub-core/fs/xfs.c @@ -595,6 +595,17 @@ grub_xfs_read_block (grub_fshelp_node_t node, grub_disk_addr_t fileblock) do { grub_uint64_t i; + grub_addr_t keys_end, data_end; + + if (grub_mul (sizeof (grub_uint64_t), nrec, &keys_end) || + grub_add ((grub_addr_t) keys, keys_end, &keys_end) || + grub_add ((grub_addr_t) node->data, node->data->data_size, &data_end) || + keys_end > data_end) + { + grub_error (GRUB_ERR_BAD_FS, "invalid number of XFS root keys"); + grub_free (leaf); + return 0; + } for (i = 0; i < nrec; i++) { -- 2.30.2