]> git.ipfire.org Git - thirdparty/grub.git/commit
luks: Fix out-of-bounds copy of UUID
authorPatrick Steinhardt <ps@pks.im>
Mon, 7 Sep 2020 15:27:36 +0000 (17:27 +0200)
committerDaniel Kiper <daniel.kiper@oracle.com>
Fri, 11 Sep 2020 13:47:39 +0000 (15:47 +0200)
commit1066336dc88ef59556be91003388d8a1dfd0fd91
tree92131835e834d23ef5d7fd0478ff35efe1bb08b2
parentb35792dccb44aff310b0461ba89abdf01d28a3f0
luks: Fix out-of-bounds copy of UUID

When configuring a LUKS disk, we copy over the UUID from the LUKS header
into the new grub_cryptodisk_t structure via grub_memcpy(). As size
we mistakenly use the size of the grub_cryptodisk_t UUID field, which
is guaranteed to be strictly bigger than the LUKS UUID field we're
copying. As a result, the copy always goes out-of-bounds and copies some
garbage from other surrounding fields. During runtime, this isn't
noticed due to the fact that we always NUL-terminate the UUID and thus
never hit the trailing garbage.

Fix the issue by using the size of the local stripped UUID field.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub-core/disk/luks.c