In the Linux kernel, the following vulnerability has been resolved: efi: Don't map the entire mokvar table to determine its size Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of earlymemmap(), and we get a failure and traceback: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/earlyioremap.c:139 _earlyioremap+0xef/0x220 ... Call Trace: <TASK> ? _earlyioremap+0xef/0x220 ? _warn.cold+0x93/0xfa ? _earlyioremap+0xef/0x220 ? reportbug+0xff/0x140 ? earlyfixupexception+0x5d/0xb0 ? earlyidthandlercommon+0x2f/0x3a ? _earlyioremap+0xef/0x220 ? efimokvartableinit+0xce/0x1d0 ? setuparch+0x864/0xc10 ? startkernel+0x6b/0xa10 ? x8664startreservations+0x24/0x30 ? x8664startkernel+0xed/0xf0 ? commonstartup64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once. Changes efimokvartable_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place.
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-azure-6.11-cloud-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-azure-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-azure-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-azure-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-lib-rust-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-headers-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-headers-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-headers-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-tools-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-6.11.0-26-generic-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-ipu6-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-ipu7-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-usbio-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-vision-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-tools-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-tools-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k-dbgsym", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-dbgsym", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-cloud-tools-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-headers-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-lib-rust-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-tools-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-headers-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-image-unsigned-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-image-unsigned-6.11.0-1022-oem-dbgsym", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-ipu6-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-ipu7-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-usbio-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-vision-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-oem-6.11-headers-6.11.0-1022", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-oem-6.11-tools-6.11.0-1022", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-tools-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" } ] }