From 05be856a8c3aae41f5df90cab7796ab7ee34b872 Mon Sep 17 00:00:00 2001 From: Lidong Chen Date: Fri, 22 Nov 2024 06:27:55 +0000 Subject: [PATCH] commands/extcmd: Missing check for failed allocation The grub_extcmd_dispatcher() calls grub_arg_list_alloc() to allocate a grub_arg_list struct but it does not verify the allocation was successful. In case of failed allocation the NULL state pointer can be accessed in parse_option() through grub_arg_parse() which may lead to a security issue. Fixes: CVE-2024-45775 Reported-by: Nils Langius Signed-off-by: Lidong Chen Reviewed-by: Daniel Kiper Reviewed-by: Alec Brown CVE: CVE-2024-45775 Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/grub.git/commit/?id=05be856a8c3aae41f5df90cab7796ab7ee34b872] Signed-off-by: Hitendra Prajapati --- grub-core/commands/extcmd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/grub-core/commands/extcmd.c b/grub-core/commands/extcmd.c index 90a5ca2..c236be1 100644 --- a/grub-core/commands/extcmd.c +++ b/grub-core/commands/extcmd.c @@ -49,6 +49,9 @@ grub_extcmd_dispatcher (struct grub_command *cmd, int argc, char **args, } state = grub_arg_list_alloc (ext, argc, args); + if (state == NULL) + return grub_errno; + if (grub_arg_parse (ext, argc, args, state, &new_args, &new_argc)) { context.state = state; -- 2.25.1