75 lines
2.9 KiB
Diff
75 lines
2.9 KiB
Diff
|
From 5e93f6c09a57dd69f1b05654455452c4a0154a79 Mon Sep 17 00:00:00 2001
|
|||
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|||
|
|
Date: Thu, 13 Jun 2024 18:35:46 -0400
|
|||
|
|
Subject: [PATCH 3/8] NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in
|
|||
|
|
iPXE environment
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|||
|
|
RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237
|
|||
|
|
RH-Jira: RHEL-40270 RHEL-40272
|
|||
|
|
RH-Acked-by: Gerd Hoffmann <None>
|
|||
|
|
RH-Commit: [3/8] 9307e82e90d6f526d303607255a4c469ebe574d4
|
|||
|
|
|
|||
|
|
JIRA: https://issues.redhat.com/browse/RHEL-40272
|
|||
|
|
Upstream: Merged
|
|||
|
|
CVE: CVE-2023-45236
|
|||
|
|
|
|||
|
|
commit ced13b93afea87a8a1fe6ddbb67240a84cb2e3d3
|
|||
|
|
Author: Sam <Sam_Tsai@wiwynn.com>
|
|||
|
|
Date: Wed May 29 07:46:03 2024 +0800
|
|||
|
|
|
|||
|
|
NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment
|
|||
|
|
|
|||
|
|
This bug fix is based on the following commit "NetworkPkg TcpDxe: SECURITY PATCH"
|
|||
|
|
REF: 1904a64
|
|||
|
|
|
|||
|
|
Issue Description:
|
|||
|
|
An "Invalid handle" error was detected during runtime when attempting to destroy a child instance of the hashing protocol. The problematic code segment was:
|
|||
|
|
|
|||
|
|
NetworkPkg\TcpDxe\TcpDriver.c
|
|||
|
|
Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, &mHash2ServiceHandle);
|
|||
|
|
|
|||
|
|
Root Cause Analysis:
|
|||
|
|
The root cause of the error was the passing of an incorrect parameter type, a pointer to an EFI_HANDLE instead of an EFI_HANDLE itself, to the DestroyChild function. This mismatch resulted in the function receiving an invalid handle.
|
|||
|
|
|
|||
|
|
Implemented Solution:
|
|||
|
|
To resolve this issue, the function call was corrected to pass mHash2ServiceHandle directly:
|
|||
|
|
|
|||
|
|
NetworkPkg\TcpDxe\TcpDriver.c
|
|||
|
|
Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, mHash2ServiceHandle);
|
|||
|
|
|
|||
|
|
This modification ensures the correct handle type is used, effectively rectifying the "Invalid handle" error.
|
|||
|
|
|
|||
|
|
Verification:
|
|||
|
|
Testing has been conducted, confirming the efficacy of the fix. Additionally, the BIOS can boot into the OS in an iPXE environment.
|
|||
|
|
|
|||
|
|
Cc: Doug Flick [MSFT] <doug.edk2@gmail.com>
|
|||
|
|
|
|||
|
|
Signed-off-by: Sam Tsai [Wiwynn] <sam_tsai@wiwynn.com>
|
|||
|
|
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
|
|||
|
|
|
|||
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|||
|
|
---
|
|||
|
|
NetworkPkg/TcpDxe/TcpDriver.c | 2 +-
|
|||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|||
|
|
|
|||
|
|
diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
|
|||
|
|
index 40bba4080c..c6e7c0df54 100644
|
|||
|
|
--- a/NetworkPkg/TcpDxe/TcpDriver.c
|
|||
|
|
+++ b/NetworkPkg/TcpDxe/TcpDriver.c
|
|||
|
|
@@ -509,7 +509,7 @@ TcpDestroyService (
|
|||
|
|
//
|
|||
|
|
// Destroy the instance of the hashing protocol for this controller.
|
|||
|
|
//
|
|||
|
|
- Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle);
|
|||
|
|
+ Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, mHash2ServiceHandle);
|
|||
|
|
if (EFI_ERROR (Status)) {
|
|||
|
|
return EFI_UNSUPPORTED;
|
|||
|
|
}
|
|||
|
|
--
|
|||
|
|
2.39.3
|
|||
|
|
|