mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 00:04:06 -09:00
This patch brings the entire stack of Debian patches on grub2 titled
"cve-2025-jan" and available at:
https://salsa.debian.org/grub-team/grub/-/tree/debian/2.12-9/debian/patches/cve-2025-jan?ref_type=tags
As of this exact Debian grub2 version 2.12-9. Some minor conflicts had
to be fixed. All patches are in upstream Grub master, but mixed with
hundreds of other changes, which is why Debian's effort to backport
them has been leveraged here.
In addition to those patches, 2 extra patches are added:
0073-net-drivers-ieee1275-ofnet-Add-missing-grub_malloc.patch
0074-Constant-time-grub_crypto_memcmp.patch
The first one fixes an issue in one of the earlier patches. The fix is
not in Debian, but is in upstream Grub.
The second one fixes another CVE, not fixed in Debian, but fixed in
OpenSUSE. This fix is not upstream as upstream has decided to move to
libgcrypt instead to avoid the problem, but that's a fairly large
change.
Overall, this patch fixes all CVEs currently reported by pkg-stats
against our grub2 package, namely:
CVE-2024-45777
CVE-2024-45778
CVE-2024-45779
CVE-2024-45780
CVE-2024-45782
CVE-2024-56737
CVE-2024-56738
CVE-2025-0678
CVE-2025-0684
CVE-2025-0685
CVE-2025-0686
CVE-2025-0689
CVE-2025-1125
With the previous fixes on runtime tests added (to use glibc
toolchains to build grub2 tests), this commit successfully passes all
tests:
- The ISO9660 tests that use grub2:
https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234563
- The grub2 tests:
https://gitlab.com/tpetazzoni/buildroot/-/pipelines/1985234685
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: also tested by building and booting
- qemu_aarch64_sbsa_defconfig
- qemu_arm_ebbr_defconfig
- qemu_loongarch64_virt_efi_defconfig
- qemu_riscv64_virt_efi_defconfig
- pc_x86_64_bios_defconfig
- pc_x86_64_efi_defconfig
]
Tested-by: Julien Olivain <ju.o@free.fr>
[Julien:
- fix patch #72 upstream link to point to the initial patch
sumbission rather than a reply
- merge two _IGNORE_CVES blocks for patch #50 into a single one
- order _IGNORE_CVES blocks by numerical patch order
- order numerically the CVE list in commit log
- add a "Fixes:" tag in patch #74 since its commit log does not
mention the CVE.
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ded3e0045a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Notes on using Grub2 for BIOS-based platforms
=============================================
1. Create a disk image
dd if=/dev/zero of=disk.img bs=1M count=32
2. Partition it (either legacy or GPT style partitions work)
cfdisk disk.img
- Create one partition, type Linux, for the root
filesystem. The only constraint is to make sure there
is enough free space *before* the first partition to
store Grub2. Leaving 1 MB of free space is safe.
3. Setup loop device and loop partitions
loop_dev=$(sudo losetup -f --show disk.img)
sudo partx -a "$loop_dev"
4. Prepare the root partition
sudo mkfs.ext3 -L root "${loop_dev}p1"
sudo mount "${loop_dev}p1" /mnt
sudo tar -C /mnt -xf output/images/rootfs.tar
sudo umount /mnt
5. Install Grub2
sudo ./output/host/sbin/grub-bios-setup \
-b ./output/host/lib/grub/i386-pc/boot.img \
-c ./output/images/grub.img -d . "$loop_dev"
6. Cleanup loop device
sudo partx -d "$loop_dev"
sudo losetup -d "$loop_dev"
7. Your disk.img is ready!
Using genimage
--------------
If you use genimage to generate your complete image,
installing Grub can be tricky. Here is how to achieve Grub's
installation with genimage:
partition boot {
in-partition-table = "no"
image = "path_to_boot.img"
offset = 0
size = 512
}
partition grub {
in-partition-table = "no"
image = "path_to_grub.img"
offset = 512
}
The result is not byte to byte identical to what
grub-bios-setup does but it works anyway.
To test your BIOS image in Qemu
-------------------------------
qemu-system-{i386,x86_64} -hda disk.img
Notes on using Grub2 for x86/x86_64 EFI-based platforms
=======================================================
1. Create a disk image
dd if=/dev/zero of=disk.img bs=1M count=32
2. Partition it with GPT partitions
cgdisk disk.img
- Create a first partition, type EF00, for the
bootloader and kernel image
- Create a second partition, type 8300, for the root
filesystem.
3. Setup loop device and loop partitions
loop_dev=$(sudo losetup -f --show disk.img)
sudo partx -a "$loop_dev"
4. Prepare the boot partition
sudo mkfs.vfat -n boot "${loop_dev}p1"
sudo mount "${loop_dev}p1" /mnt
sudo cp -a output/images/efi-part/* /mnt/
sudo cp output/images/bzImage /mnt/
sudo umount /mnt
5. Prepare the root partition
sudo mkfs.ext3 -L root "${loop_dev}p2"
sudo mount "${loop_dev}p2" /mnt
sudo tar -C /mnt -xf output/images/rootfs.tar
sudo umount /mnt
6 Cleanup loop device
sudo partx -d "$loop_dev"
sudo losetup -d "$loop_dev"
7. Your disk.img is ready!
To test your i386/x86-64 EFI image in Qemu
------------------------------------------
1. Download/install the EFI BIOS for Qemu
You can get it using the edk2 package in Buildroot (installed
in BINARIES_DIR), grab prebuilt images from the unofficial nightly
builds [0], or use one provided by your distribution as OVMF.
[0] https://github.com/retrage/edk2-nightly
2. qemu-system-{i386,x86_64} -bios <path-to-OVMF.fd> -hda disk.img
Notes on using Grub2 for ARM u-boot-based platforms
===================================================
The following steps show how to use the Grub2 arm-uboot platform
support in the simplest way possible and with a single
buildroot-generated filesystem.
1. Load qemu_arm_vexpress_defconfig
2. Enable u-boot with the vexpress_ca9x4 board name and with
u-boot.elf image format.
3. Enable grub2 for the arm-uboot platform.
4. Enable "Install kernel image to /boot in target" in the kernel
menu to populate a /boot directory with zImage in it.
5. The upstream u-boot vexpress_ca9x4 doesn't have CONFIG_API enabled
by default, which is required.
Before building, patch u-boot (for example, make u-boot-extract to
edit the source before building) file
include/configs/vexpress_common.h to define:
#define CONFIG_API
#define CONFIG_SYS_MMC_MAX_DEVICE 1
6. Create a custom grub2 config file with the following contents and
set its path in BR2_TARGET_GRUB2_CFG:
set default="0"
set timeout="5"
menuentry "Buildroot" {
set root='(hd0)'
linux /boot/zImage root=/dev/mmcblk0 console=ttyAMA0
devicetree /boot/vexpress-v2p-ca9.dtb
}
7. Create a custom builtin config file with the following contents
and set its path in BR2_TARGET_GRUB2_BUILTIN_CONFIG:
set root=(hd0)
set prefix=/boot/grub
8. Create a custom post-build script which copies files from
${BINARIES_DIR}/boot-part to $(TARGET_DIR)/boot (set its path in
BR2_ROOTFS_POST_BUILD_SCRIPT):
#!/bin/sh
cp -r ${BINARIES_DIR}/boot-part/* ${TARGET_DIR}/boot/
9. make
10. Run qemu with:
qemu-system-arm -M vexpress-a9 -kernel output/images/u-boot -m 1024 \
-nographic -sd output/images/rootfs.ext2
11. In u-boot, stop at the prompt and run grub2 with:
=> ext2load mmc 0:0 ${loadaddr} /boot/grub/grub.img
=> bootm
12. This should bring the grub2 menu, upon which selecting the "Buildroot"
entry should boot Linux.
Notes on using Grub2 for Aarch64 EFI-based platforms
====================================================
The following steps show how to use the Grub2 arm64-efi platform,
using qemu and EFI firmware built for qemu.
1. Load aarch64_efi_defconfig
2. make
3. Download the EFI firmware for qemu aarch64
You can get it using the edk2 package in Buildroot (installed
in BINARIES_DIR), grab prebuilt images from the unofficial nightly
builds [1], or use one provided by your distribution as OVMF-aarch64
or AAVMF.
[1] https://github.com/retrage/edk2-nightly
4. Run qemu with:
qemu-system-aarch64 -M virt -cpu cortex-a57 -m 512 -nographic \
-bios <path/to/EDK2>/QEMU_EFI.fd -hda output/images/disk.img \
-netdev user,id=eth0 -device virtio-net-device,netdev=eth0
5. This should bring the grub2 menu, upon which selecting the
"Buildroot" entry should boot Linux.