From 7580addfc8c94cedb0cdfd7a1fd65b539215e637 Mon Sep 17 00:00:00 2001 From: B Horn Date: Fri, 1 Nov 2024 23:52:06 +0000 Subject: [PATCH 3/3] gettext: Remove variables hooks on module unload The gettext module does not entirely cleanup after itself in its GRUB_MOD_FINI() leaving a few variables hooks in place. It is not possible to unload gettext module because normal module depends on it. Though fix the issues for completeness. Fixes: CVE-2025-0622 Reported-by: B Horn Signed-off-by: B Horn Reviewed-by: Daniel Kiper CVE: CVE-2025-0622 Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=7580addfc8c94cedb0cdfd7a1fd65b539215e637] Signed-off-by: Hitendra Prajapati --- grub-core/gettext/gettext.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/grub-core/gettext/gettext.c b/grub-core/gettext/gettext.c index 85ea44a..7a25c9d 100644 --- a/grub-core/gettext/gettext.c +++ b/grub-core/gettext/gettext.c @@ -540,6 +540,10 @@ GRUB_MOD_INIT (gettext) GRUB_MOD_FINI (gettext) { + grub_register_variable_hook ("locale_dir", NULL, NULL); + grub_register_variable_hook ("secondary_locale_dir", NULL, NULL); + grub_register_variable_hook ("lang", NULL, NULL); + grub_gettext_delete_list (&main_context); grub_gettext_delete_list (&secondary_context); -- 2.25.1