67 lines
2.5 KiB
Diff
67 lines
2.5 KiB
Diff
From 3351bd0ba07cc490c344d2dc54b86833993ca5a2 Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Thu, 20 Jun 2024 15:58:58 -0400
|
|
Subject: [PATCH 18/31] MdePkg/DxeRngLib: Request raw algorithm instead of
|
|
default
|
|
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
RH-MergeRequest: 77: UINT32 overflow in S3 ResumeCount and Pixiefail fixes
|
|
RH-Jira: RHEL-21854 RHEL-21856 RHEL-40099
|
|
RH-Acked-by: Gerd Hoffmann <None>
|
|
RH-Commit: [18/31] fa2da700127ae713aa578638c2390673fc49522d
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-21856
|
|
Upstream: Merged
|
|
CVE: CVE-2023-45237
|
|
|
|
commit bd1f0eecc1dfe51ba20161bef8860d12392006bd
|
|
Author: Pierre Gondois <pierre.gondois@arm.com>
|
|
Date: Fri Aug 11 16:33:05 2023 +0200
|
|
|
|
MdePkg/DxeRngLib: Request raw algorithm instead of default
|
|
|
|
The DxeRngLib tries to generate a random number using the 3 NIST
|
|
SP 800-90 compliant DRBG algorithms, i.e. 256-bits CTR, HASH and HMAC.
|
|
If none of the call is successful, the fallback option is the default
|
|
RNG algorithm of the EFI_RNG_PROTOCOL. This default algorithm might
|
|
be an unsafe implementation.
|
|
|
|
Try requesting the Raw algorithm before requesting the default one.
|
|
|
|
Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
|
|
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
|
|
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
|
|
Acked-by: Ard Biesheuvel <ardb@kernel.org>
|
|
Tested-by: Kun Qin <kun.qin@microsoft.com>
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
---
|
|
MdePkg/Library/DxeRngLib/DxeRngLib.c | 9 ++++++++-
|
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c b/MdePkg/Library/DxeRngLib/DxeRngLib.c
|
|
index 9c3d67b5a6..4b2fc1cde5 100644
|
|
--- a/MdePkg/Library/DxeRngLib/DxeRngLib.c
|
|
+++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
|
|
@@ -64,9 +64,16 @@ GenerateRandomNumberViaNist800Algorithm (
|
|
if (!EFI_ERROR (Status)) {
|
|
return Status;
|
|
}
|
|
+
|
|
+ Status = RngProtocol->GetRNG (RngProtocol, &gEfiRngAlgorithmRaw, BufferSize, Buffer);
|
|
+ DEBUG ((DEBUG_INFO, "%a: GetRNG algorithm Raw - Status = %r\n", __func__, Status));
|
|
+ if (!EFI_ERROR (Status)) {
|
|
+ return Status;
|
|
+ }
|
|
+
|
|
// If all the other methods have failed, use the default method from the RngProtocol
|
|
Status = RngProtocol->GetRNG (RngProtocol, NULL, BufferSize, Buffer);
|
|
- DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n", __FUNCTION__, Status));
|
|
+ DEBUG ((DEBUG_INFO, "%a: GetRNG algorithm default - Status = %r\n", __func__, Status));
|
|
if (!EFI_ERROR (Status)) {
|
|
return Status;
|
|
}
|
|
--
|
|
2.39.3
|
|
|