[bug #59887] potential truncation of mdraid device list

[Kees Cook]

URL:
  <https://savannah.gnu.org/bugs/?59887>

                 Summary: potential truncation of mdraid device list
                 Project: GNU GRUB
            Submitted by: keescook
            Submitted on: Sat 16 Jan 2021 10:49:30 AM UTC
                Category: Installation
                Severity: Major
                Priority: 5 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
         Originator Name: 
        Originator Email: 
             Open/Closed: Open
                 Release: 
                 Release: 2.02
         Discussion Lock: Any
         Reproducibility: Every Time
         Planned Release: None

    _______________________________________________________

Details:

The consumer of grub_util_raid_getmembers() expects a NULL terminated list of
device names. It has no idea about how many devices are registered in the
array; it only cares about active devices. As a result, there cannot be gaps
in the list, otherwise the first listed inactive device will cause all
remaining devices to effectively vanish. This is especially troublesome if a
root filesystem were on an array with the first device being a hot spare: the
array would appear to have no disks and the root filesystem would become
invisible to grub.

https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1912043



    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Sat 16 Jan 2021 10:49:30 AM UTC  Name:
fix-md-array-list-truncation.patch  Size: 2KiB   By: keescook

<http://savannah.gnu.org/bugs/download.php?file_id=50724>

    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?59887>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/