149 lines
4.6 KiB
Diff
149 lines
4.6 KiB
Diff
From 0ef57f5f435ee1909d14da24cd1c3edc91fef405 Mon Sep 17 00:00:00 2001
|
|
From: Jon Maloy <jmaloy@redhat.com>
|
|
Date: Sat, 6 Apr 2024 11:00:29 -0400
|
|
Subject: [PATCH 2/2] StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
|
|
|
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
RH-MergeRequest: 69: EmbeddedPkg/Hob: Integer Overflow in CreateHob()
|
|
RH-Jira: RHEL-30156
|
|
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
|
RH-Acked-by: Gerd Hoffmann <None>
|
|
RH-Commit: [2/2] 3c3454688975f62041dd8d3393f0bba5ec3b71f1
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-30156
|
|
CVE: CVE-2022-36765
|
|
Upstream: Merged
|
|
|
|
commit 9a75b030cf27d2530444e9a2f9f11867f79bf679
|
|
Author: Gua Guo <gua.guo@intel.com>
|
|
Date: Thu Jan 11 13:03:26 2024 +0800
|
|
|
|
StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
|
|
|
|
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
|
|
|
|
Fix integer overflow in various CreateHob instances.
|
|
Fixes: CVE-2022-36765
|
|
|
|
The CreateHob() function aligns the requested size to 8
|
|
performing the following operation:
|
|
```
|
|
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
|
|
```
|
|
|
|
No checks are performed to ensure this value doesn't
|
|
overflow, and could lead to CreateHob() returning a smaller
|
|
HOB than requested, which could lead to OOB HOB accesses.
|
|
|
|
Reported-by: Marc Beatove <mbeatove@google.com>
|
|
Reviewed-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
|
|
Cc: Sami Mujawar <sami.mujawar@arm.com>
|
|
Reviewed-by: Ray Ni <ray.ni@intel.com>
|
|
Cc: John Mathew <john.mathews@intel.com>
|
|
Authored-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Signed-off-by: Gua Guo <gua.guo@intel.com>
|
|
|
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
---
|
|
.../Arm/StandaloneMmCoreHobLib.c | 35 +++++++++++++++++++
|
|
1 file changed, 35 insertions(+)
|
|
|
|
diff --git a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
|
|
index 1550e1babc..59473e28fe 100644
|
|
--- a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
|
|
+++ b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
|
|
@@ -34,6 +34,13 @@ CreateHob (
|
|
|
|
HandOffHob = GetHobList ();
|
|
|
|
+ //
|
|
+ // Check Length to avoid data overflow.
|
|
+ //
|
|
+ if (HobLength > MAX_UINT16 - 0x7) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
|
|
|
|
FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
|
|
@@ -89,6 +96,10 @@ BuildModuleHob (
|
|
);
|
|
|
|
Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_MODULE));
|
|
+ ASSERT (Hob != NULL);
|
|
+ if (Hob == NULL) {
|
|
+ return;
|
|
+ }
|
|
|
|
CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModuleGuid);
|
|
Hob->MemoryAllocationHeader.MemoryBaseAddress = MemoryAllocationModule;
|
|
@@ -129,6 +140,9 @@ BuildResourceDescriptorHob (
|
|
|
|
Hob = CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RESOURCE_DESCRIPTOR));
|
|
ASSERT (Hob != NULL);
|
|
+ if (Hob == NULL) {
|
|
+ return;
|
|
+ }
|
|
|
|
Hob->ResourceType = ResourceType;
|
|
Hob->ResourceAttribute = ResourceAttribute;
|
|
@@ -167,6 +181,11 @@ BuildGuidHob (
|
|
ASSERT (DataLength <= (0xffff - sizeof (EFI_HOB_GUID_TYPE)));
|
|
|
|
Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB_GUID_TYPE) + DataLength));
|
|
+ ASSERT (Hob != NULL);
|
|
+ if (Hob == NULL) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
CopyGuid (&Hob->Name, Guid);
|
|
return Hob + 1;
|
|
}
|
|
@@ -226,6 +245,10 @@ BuildFvHob (
|
|
EFI_HOB_FIRMWARE_VOLUME *Hob;
|
|
|
|
Hob = CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));
|
|
+ ASSERT (Hob != NULL);
|
|
+ if (Hob == NULL) {
|
|
+ return;
|
|
+ }
|
|
|
|
Hob->BaseAddress = BaseAddress;
|
|
Hob->Length = Length;
|
|
@@ -255,6 +278,10 @@ BuildFv2Hob (
|
|
EFI_HOB_FIRMWARE_VOLUME2 *Hob;
|
|
|
|
Hob = CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));
|
|
+ ASSERT (Hob != NULL);
|
|
+ if (Hob == NULL) {
|
|
+ return;
|
|
+ }
|
|
|
|
Hob->BaseAddress = BaseAddress;
|
|
Hob->Length = Length;
|
|
@@ -282,6 +309,10 @@ BuildCpuHob (
|
|
EFI_HOB_CPU *Hob;
|
|
|
|
Hob = CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));
|
|
+ ASSERT (Hob != NULL);
|
|
+ if (Hob == NULL) {
|
|
+ return;
|
|
+ }
|
|
|
|
Hob->SizeOfMemorySpace = SizeOfMemorySpace;
|
|
Hob->SizeOfIoSpace = SizeOfIoSpace;
|
|
@@ -319,6 +350,10 @@ BuildMemoryAllocationHob (
|
|
);
|
|
|
|
Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION));
|
|
+ ASSERT (Hob != NULL);
|
|
+ if (Hob == NULL) {
|
|
+ return;
|
|
+ }
|
|
|
|
ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));
|
|
Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
|
|
--
|
|
2.39.3
|
|
|