oss-security - [SECURITY PATCH 5/8] normal/main: Unregister commands on module unload

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251118180021.2890-6-daniel.kiper@oracle.com>
Date: Tue, 18 Nov 2025 19:00:18 +0100
From: Daniel Kiper <daniel.kiper@...cle.com>
To: grub-devel@....org, oss-security@...ts.openwall.com
Cc: alec.r.brown@...cle.com, glin@...e.com, mbenatto@...hat.com,
        mchang@...e.com, meissner@...e.com, tf@...ay.de, volticks@...il.com
Subject: [SECURITY PATCH 5/8] normal/main: Unregister commands on module unload

From: Alec Brown <alec.r.brown@...cle.com>

When the normal module is loaded, the normal and normal_exit commands
are registered but aren't unregistered when the module is unloaded. We
need to add calls to grub_unregister_command() when unloading the module
for these commands.

Fixes: CVE-2025-61663
Fixes: CVE-2025-61664

Reported-by: Alec Brown <alec.r.brown@...cle.com>
Signed-off-by: Alec Brown <alec.r.brown@...cle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@...cle.com>
---
 grub-core/normal/main.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/grub-core/normal/main.c b/grub-core/normal/main.c
index 8c2acf938..de9a3f961 100644
--- a/grub-core/normal/main.c
+++ b/grub-core/normal/main.c
@@ -510,7 +510,7 @@ grub_mini_cmd_clear (struct grub_command *cmd __attribute__ ((unused)),
   return 0;
 }
 
-static grub_command_t cmd_clear;
+static grub_command_t cmd_clear, cmd_normal, cmd_normal_exit;
 
 static void (*grub_xputs_saved) (const char *str);
 static const char *features[] = {
@@ -554,10 +554,10 @@ GRUB_MOD_INIT(normal)
   grub_env_export ("pager");
 
   /* Register a command "normal" for the rescue mode.  */
-  grub_register_command ("normal", grub_cmd_normal,
-			 0, N_("Enter normal mode."));
-  grub_register_command ("normal_exit", grub_cmd_normal_exit,
-			 0, N_("Exit from normal mode."));
+  cmd_normal = grub_register_command ("normal", grub_cmd_normal,
+				      0, N_("Enter normal mode."));
+  cmd_normal_exit = grub_register_command ("normal_exit", grub_cmd_normal_exit,
+					   0, N_("Exit from normal mode."));
 
   /* Reload terminal colors when these variables are written to.  */
   grub_register_variable_hook ("color_normal", NULL, grub_env_write_color_normal);
@@ -599,4 +599,6 @@ GRUB_MOD_FINI(normal)
   grub_register_variable_hook ("color_highlight", NULL, NULL);
   grub_fs_autoload_hook = 0;
   grub_unregister_command (cmd_clear);
+  grub_unregister_command (cmd_normal);
+  grub_unregister_command (cmd_normal_exit);
 }
-- 
2.11.0

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.