* Tue Oct 08 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240524-9
- edk2-OvmfPkg-VirtioGpuDxe-ignore-display-resolutions-smal.patch [RHEL-56249] - edk2-OvmfPkg-QemuVideoDxe-ignore-display-resolutions-smal.patch [RHEL-56249] - edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch [RHEL-60829] - Resolves: RHEL-56249 (507x510 display resolution should not crash the firmware [edk2,rhel-10]) - Resolves: RHEL-60829 (CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-10.0])
This commit is contained in:
Miroslav Rezanina
parent
5d71fdbfa7
commit
0ee4bc0f62
50
edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
Normal file
50
edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
From f0facba2e1458636c73399b8b0aea8c8db47f5f2 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jon Maloy <jmaloy@redhat.com>
|
||||||
|
Date: Tue, 1 Oct 2024 18:40:41 -0400
|
||||||
|
Subject: [PATCH 3/3] MdePkg: Fix overflow issue in BasePeCoffLib
|
||||||
|
|
||||||
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
||||||
|
RH-MergeRequest: 79: MdePkg: Fix overflow issue in BasePeCoffLib
|
||||||
|
RH-Jira: RHEL-60829
|
||||||
|
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
||||||
|
RH-Commit: [1/1] 295f85a105fe778de5e555a65fdd2b7297c721a6
|
||||||
|
|
||||||
|
JIRA: https://issues.redhat.com/browse/RHEL-60829
|
||||||
|
CVE: CVE-2024-38796
|
||||||
|
Upstream: Merged
|
||||||
|
|
||||||
|
commit c95233b8525ca6828921affd1496146cff262e65
|
||||||
|
Author: Doug Flick <dougflick@microsoft.com>
|
||||||
|
Date: Fri Sep 27 12:08:55 2024 -0700
|
||||||
|
|
||||||
|
MdePkg: Fix overflow issue in BasePeCoffLib
|
||||||
|
|
||||||
|
The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is
|
||||||
|
also a UINT32 value. The current code does not check for overflow when
|
||||||
|
adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a
|
||||||
|
check to ensure that the addition does not overflow.
|
||||||
|
|
||||||
|
Signed-off-by: Doug Flick <dougflick@microsoft.com>
|
||||||
|
Authored-by: sriraamx gobichettipalayam <sri..@intel.com>
|
||||||
|
|
||||||
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
||||||
|
---
|
||||||
|
MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
||||||
|
index 86ff2e769b..128090d98e 100644
|
||||||
|
--- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
||||||
|
+++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
||||||
|
@@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage (
|
||||||
|
RelocDir = &Hdr.Te->DataDirectory[0];
|
||||||
|
}
|
||||||
|
|
||||||
|
- if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
|
||||||
|
+ if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
|
||||||
|
RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
|
||||||
|
RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
|
||||||
|
ImageContext,
|
||||||
|
--
|
||||||
|
2.39.3
|
||||||
|
|
||||||
@ -0,0 +1,65 @@
|
|||||||
|
From 0ddcdbae55f2dd6bbd4c4893ecfc0feeb21b9d91 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
Date: Fri, 23 Aug 2024 14:36:16 +0200
|
||||||
|
Subject: [PATCH 2/3] OvmfPkg/QemuVideoDxe: ignore display resolutions smaller
|
||||||
|
than 640x480
|
||||||
|
|
||||||
|
RH-Author: Gerd Hoffmann <None>
|
||||||
|
RH-MergeRequest: 73: ignore display resolutions smaller than 640x480
|
||||||
|
RH-Jira: RHEL-56249
|
||||||
|
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
||||||
|
RH-Commit: [2/2] 95d973e06f759c00637831a9521063794ce5cf28 (kraxel.rh/centos-src-edk2)
|
||||||
|
|
||||||
|
GraphicsConsoleDxe will assert in case the resolution is too small.
|
||||||
|
|
||||||
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
(cherry picked from commit 391666da2c1dc5671bbb3393079d86f46e3435af)
|
||||||
|
---
|
||||||
|
OvmfPkg/QemuVideoDxe/Initialize.c | 18 ++++++++++++++----
|
||||||
|
1 file changed, 14 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/OvmfPkg/QemuVideoDxe/Initialize.c b/OvmfPkg/QemuVideoDxe/Initialize.c
|
||||||
|
index 050ae878ec..2d1f50637f 100644
|
||||||
|
--- a/OvmfPkg/QemuVideoDxe/Initialize.c
|
||||||
|
+++ b/OvmfPkg/QemuVideoDxe/Initialize.c
|
||||||
|
@@ -293,6 +293,8 @@ QemuVideoBochsEdid (
|
||||||
|
)
|
||||||
|
{
|
||||||
|
EFI_STATUS Status;
|
||||||
|
+ UINT32 X;
|
||||||
|
+ UINT32 Y;
|
||||||
|
|
||||||
|
if (Private->Variant != QEMU_VIDEO_BOCHS_MMIO) {
|
||||||
|
return;
|
||||||
|
@@ -344,16 +346,24 @@ QemuVideoBochsEdid (
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
- *XRes = Private->Edid[56] | ((Private->Edid[58] & 0xf0) << 4);
|
||||||
|
- *YRes = Private->Edid[59] | ((Private->Edid[61] & 0xf0) << 4);
|
||||||
|
+ X = Private->Edid[56] | ((Private->Edid[58] & 0xf0) << 4);
|
||||||
|
+ Y = Private->Edid[59] | ((Private->Edid[61] & 0xf0) << 4);
|
||||||
|
DEBUG ((
|
||||||
|
DEBUG_INFO,
|
||||||
|
"%a: default resolution: %dx%d\n",
|
||||||
|
__func__,
|
||||||
|
- *XRes,
|
||||||
|
- *YRes
|
||||||
|
+ X,
|
||||||
|
+ Y
|
||||||
|
));
|
||||||
|
|
||||||
|
+ if ((X < 640) || (Y < 480)) {
|
||||||
|
+ /* ignore hint, GraphicsConsoleDxe needs 640x480 or larger */
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ *XRes = X;
|
||||||
|
+ *YRes = Y;
|
||||||
|
+
|
||||||
|
if (PcdGet8 (PcdVideoResolutionSource) == 0) {
|
||||||
|
Status = PcdSet32S (PcdVideoHorizontalResolution, *XRes);
|
||||||
|
ASSERT_RETURN_ERROR (Status);
|
||||||
|
--
|
||||||
|
2.39.3
|
||||||
|
|
||||||
@ -0,0 +1,37 @@
|
|||||||
|
From 66b4a85fcb8ec13c5e4e152d1265dbf31eaa34f3 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
Date: Fri, 23 Aug 2024 14:35:53 +0200
|
||||||
|
Subject: [PATCH 1/3] OvmfPkg/VirtioGpuDxe: ignore display resolutions smaller
|
||||||
|
than 640x480
|
||||||
|
|
||||||
|
RH-Author: Gerd Hoffmann <None>
|
||||||
|
RH-MergeRequest: 73: ignore display resolutions smaller than 640x480
|
||||||
|
RH-Jira: RHEL-56249
|
||||||
|
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
||||||
|
RH-Commit: [1/2] 24ec635d43a396ceb50197136ad7ffdc4a614a47 (kraxel.rh/centos-src-edk2)
|
||||||
|
|
||||||
|
GraphicsConsoleDxe will assert in case the resolution is too small.
|
||||||
|
|
||||||
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
(cherry picked from commit 58035e8b5e11cfe2b9e6428d14c7817b6b1c83a2)
|
||||||
|
---
|
||||||
|
OvmfPkg/VirtioGpuDxe/Gop.c | 3 ++-
|
||||||
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/OvmfPkg/VirtioGpuDxe/Gop.c b/OvmfPkg/VirtioGpuDxe/Gop.c
|
||||||
|
index f64dfce5f4..d767114bbb 100644
|
||||||
|
--- a/OvmfPkg/VirtioGpuDxe/Gop.c
|
||||||
|
+++ b/OvmfPkg/VirtioGpuDxe/Gop.c
|
||||||
|
@@ -265,7 +265,8 @@ GopInitialize (
|
||||||
|
// query host for display resolution
|
||||||
|
//
|
||||||
|
GopNativeResolution (VgpuGop, &XRes, &YRes);
|
||||||
|
- if ((XRes == 0) || (YRes == 0)) {
|
||||||
|
+ if ((XRes < 640) || (YRes < 480)) {
|
||||||
|
+ /* ignore hint, GraphicsConsoleDxe needs 640x480 or larger */
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.39.3
|
||||||
|
|
||||||
17
edk2.spec
17
edk2.spec
@ -21,7 +21,7 @@ ExclusiveArch: x86_64 aarch64
|
|||||||
|
|
||||||
Name: edk2
|
Name: edk2
|
||||||
Version: %{GITDATE}
|
Version: %{GITDATE}
|
||||||
Release: 8%{?dist}
|
Release: 9%{?dist}
|
||||||
Summary: UEFI firmware for 64-bit virtual machines
|
Summary: UEFI firmware for 64-bit virtual machines
|
||||||
License: BSD-2-Clause-Patent and Apache-2.0 and MIT
|
License: BSD-2-Clause-Patent and Apache-2.0 and MIT
|
||||||
URL: http://www.tianocore.org
|
URL: http://www.tianocore.org
|
||||||
@ -101,6 +101,12 @@ Patch42: edk2-AmdSevDxe-Fix-the-shim-fallback-reboot-workaround-fo.patch
|
|||||||
Patch43: edk2-UefiCpuPkg-PiSmmCpuDxeSmm-skip-PatchInstructionX86-c.patch
|
Patch43: edk2-UefiCpuPkg-PiSmmCpuDxeSmm-skip-PatchInstructionX86-c.patch
|
||||||
# For RHEL-56154 - qemu-kvm: warning: Blocked re-entrant IO on MemoryRegion: acpi-cpu-hotplug at addr: 0x0 [rhel-10]
|
# For RHEL-56154 - qemu-kvm: warning: Blocked re-entrant IO on MemoryRegion: acpi-cpu-hotplug at addr: 0x0 [rhel-10]
|
||||||
Patch44: edk2-OvmfPkg-CpuHotplugSmm-delay-SMM-exit.patch
|
Patch44: edk2-OvmfPkg-CpuHotplugSmm-delay-SMM-exit.patch
|
||||||
|
# For RHEL-56249 - 507x510 display resolution should not crash the firmware [edk2,rhel-10]
|
||||||
|
Patch45: edk2-OvmfPkg-VirtioGpuDxe-ignore-display-resolutions-smal.patch
|
||||||
|
# For RHEL-56249 - 507x510 display resolution should not crash the firmware [edk2,rhel-10]
|
||||||
|
Patch46: edk2-OvmfPkg-QemuVideoDxe-ignore-display-resolutions-smal.patch
|
||||||
|
# For RHEL-60829 - CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-10.0]
|
||||||
|
Patch47: edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
|
||||||
|
|
||||||
# python3-devel and libuuid-devel are required for building tools.
|
# python3-devel and libuuid-devel are required for building tools.
|
||||||
# python3-devel is also needed for varstore template generation and
|
# python3-devel is also needed for varstore template generation and
|
||||||
@ -435,6 +441,15 @@ install -m 0644 \
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Oct 08 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240524-9
|
||||||
|
- edk2-OvmfPkg-VirtioGpuDxe-ignore-display-resolutions-smal.patch [RHEL-56249]
|
||||||
|
- edk2-OvmfPkg-QemuVideoDxe-ignore-display-resolutions-smal.patch [RHEL-56249]
|
||||||
|
- edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch [RHEL-60829]
|
||||||
|
- Resolves: RHEL-56249
|
||||||
|
(507x510 display resolution should not crash the firmware [edk2,rhel-10])
|
||||||
|
- Resolves: RHEL-60829
|
||||||
|
(CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-10.0])
|
||||||
|
|
||||||
* Fri Sep 27 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240524-8
|
* Fri Sep 27 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20240524-8
|
||||||
- edk2-Bumped-openssl-submodule-version-to-0205b5898872.patch [RHEL-55302]
|
- edk2-Bumped-openssl-submodule-version-to-0205b5898872.patch [RHEL-55302]
|
||||||
- Resolves: RHEL-55302
|
- Resolves: RHEL-55302
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user