回复: [edk2-devel][edk2-stable202405][PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount

["gaoliming via groups.io" <gaoliming=byosoft.com.cn@groups.io>]

Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>

This is a security fix. So, I think it should catch this stable tag 202405

Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Pakkirisamy
> ShanmugavelX
> 发送时间: 2024年5月6日 17:53
> 收件人: devel@edk2.groups.io
> 抄送: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>;
> Zhiguang Liu <zhiguang.liu@intel.com>; Dandan Bi <dandan.bi@intel.com>;
> Liming Gao <gaoliming@byosoft.com.cn>
> 主题: [edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3
> ResumeCount
> 
> From: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677
> 
> Attacker able to modify physical memory and ResumeCount.
> System will crash/DoS when ResumeCount reaches its MAX_UINT32.
> 
> Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> Cc: Dandan Bi <dandan.bi@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> 
> Signed-off-by: Pakkirisamy ShanmugavelX
> <shanmugavelx.pakkirisamy@intel.com>
> ---
> 
> MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePe
> rformancePei.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git
> a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> index 2f2b2a80b2..1035ed8640 100644
> ---
> a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> +++
> b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> @@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei (
>    //
>    S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume,
> AcpiS3ResumeRecord->ResumeCount);
>    AcpiS3ResumeRecord->ResumeCount++;
> -  AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> -
> -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount
> = %d\n", AcpiS3ResumeRecord->ResumeCount));
> -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume
> = %ld\n", AcpiS3ResumeRecord->FullResume));
> -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume
> = %ld\n", AcpiS3ResumeRecord->AverageResume));
> +  if (AcpiS3ResumeRecord->ResumeCount > 0) {
> +    AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> +    DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance -
> AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
> +  }
> +  else {
> +    DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the
> MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
> +  }
> +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   =
> 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
> +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    =
> 0x%x\n", AcpiS3ResumeRecord->FullResume));
> 
>    //
>    // Update S3 Suspend Performance Record.
> --
> 2.45.0.windows.1
> 
> 
> 
> 
> 





-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118745): https://edk2.groups.io/g/devel/message/118745
Mute This Topic: https://groups.io/mt/105997183/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-