]> git.ipfire.org Git - thirdparty/grub.git/commit
kern/efi/mm: Fix use-after-free in finish boot services
authorAlec Brown <alec.r.brown@oracle.com>
Mon, 22 May 2023 20:52:49 +0000 (16:52 -0400)
committerDaniel Kiper <daniel.kiper@oracle.com>
Thu, 25 May 2023 14:48:00 +0000 (16:48 +0200)
commit6f05a277961dc801ba6de4f0f3bc22184ae80b0f
tree55fbe57e7e660f4839ad55183a839c6035e09d86
parentf00ddc6834410adb9762ef0873573e86dce8294b
kern/efi/mm: Fix use-after-free in finish boot services

In grub-core/kern/efi/mm.c, grub_efi_finish_boot_services() has an instance
where the memory for the variable finish_mmap_buf is freed, but on the next
iteration of a while loop, grub_efi_get_memory_map() uses finish_mmap_buf. To
prevent this, we can set finish_mmap_buf to NULL after the free.

Signed-off-by: Alec Brown <alec.r.brown@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/kern/efi/mm.c