[edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount

[edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount

[Pakkirisamy ShanmugavelX]

From: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677

Attacker able to modify physical memory and ResumeCount.
System will crash/DoS when ResumeCount reaches its MAX_UINT32.

Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Dandan Bi <dandan.bi@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>

Signed-off-by: Pakkirisamy ShanmugavelX <shanmugavelx.pakkirisamy@intel.com>
---
 MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
index 2f2b2a80b2..1035ed8640 100644
--- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
+++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
@@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei (
   //
   S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, AcpiS3ResumeRecord->ResumeCount);
   AcpiS3ResumeRecord->ResumeCount++;
-  AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
-
-  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   = %d\n", AcpiS3ResumeRecord->ResumeCount));
-  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    = %ld\n", AcpiS3ResumeRecord->FullResume));
-  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume = %ld\n", AcpiS3ResumeRecord->AverageResume));
+  if (AcpiS3ResumeRecord->ResumeCount > 0) {
+    AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
+    DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance - AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
+  }
+  else {
+    DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
+  }
+  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   = 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
+  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    = 0x%x\n", AcpiS3ResumeRecord->FullResume));
 
   //
   // Update S3 Suspend Performance Record.
-- 
2.45.0.windows.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118659): https://edk2.groups.io/g/devel/message/118659
Mute This Topic: https://groups.io/mt/105977011/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-

回复: [edk2-devel][edk2-stable202405][PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount

[gaoliming via groups.io]

Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>

This is a security fix. So, I think it should catch this stable tag 202405

Thanks
Liming
> -----邮件原件-----
> 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Pakkirisamy
> ShanmugavelX
> 发送时间: 2024年5月6日 17:53
> 收件人: devel@edk2.groups.io
> 抄送: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>;
> Zhiguang Liu <zhiguang.liu@intel.com>; Dandan Bi <dandan.bi@intel.com>;
> Liming Gao <gaoliming@byosoft.com.cn>
> 主题: [edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3
> ResumeCount
> 
> From: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677
> 
> Attacker able to modify physical memory and ResumeCount.
> System will crash/DoS when ResumeCount reaches its MAX_UINT32.
> 
> Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> Cc: Dandan Bi <dandan.bi@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> 
> Signed-off-by: Pakkirisamy ShanmugavelX
> <shanmugavelx.pakkirisamy@intel.com>
> ---
> 
> MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePe
> rformancePei.c | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git
> a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> index 2f2b2a80b2..1035ed8640 100644
> ---
> a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> +++
> b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> PerformancePei.c
> @@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei (
>    //
>    S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume,
> AcpiS3ResumeRecord->ResumeCount);
>    AcpiS3ResumeRecord->ResumeCount++;
> -  AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> -
> -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount
> = %d\n", AcpiS3ResumeRecord->ResumeCount));
> -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume
> = %ld\n", AcpiS3ResumeRecord->FullResume));
> -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume
> = %ld\n", AcpiS3ResumeRecord->AverageResume));
> +  if (AcpiS3ResumeRecord->ResumeCount > 0) {
> +    AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> +    DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance -
> AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
> +  }
> +  else {
> +    DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the
> MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
> +  }
> +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   =
> 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
> +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    =
> 0x%x\n", AcpiS3ResumeRecord->FullResume));
> 
>    //
>    // Update S3 Suspend Performance Record.
> --
> 2.45.0.windows.1
> 
> 
> 
> 
> 





-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118745): https://edk2.groups.io/g/devel/message/118745
Mute This Topic: https://groups.io/mt/105997183/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-

Re: [edk2-devel][edk2-stable202405][PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount

[Michael D Kinney]

I agree it should catch edk2-stable202405

Mike

> -----Original Message-----
> From: gaoliming <gaoliming@byosoft.com.cn>
> Sent: Thursday, May 9, 2024 12:24 AM
> To: devel@edk2.groups.io; Pakkirisamy, ShanmugavelX
> <shanmugavelx.pakkirisamy@intel.com>
> Cc: Liu, Zhiguang <zhiguang.liu@intel.com>; Bi, Dandan <dandan.bi@intel.com>;
> 'Leif Lindholm' <quic_llindhol@quicinc.com>; 'Andrew Fish' <afish@apple.com>;
> Kinney, Michael D <michael.d.kinney@intel.com>
> Subject: 回复: [edk2-devel][edk2-stable202405][PATCH] MdeModulePkg: Potential
> UINT32 overflow in S3 ResumeCount
> 
> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> 
> This is a security fix. So, I think it should catch this stable tag 202405
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Pakkirisamy
> > ShanmugavelX
> > 发送时间: 2024年5月6日 17:53
> > 收件人: devel@edk2.groups.io
> > 抄送: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>;
> > Zhiguang Liu <zhiguang.liu@intel.com>; Dandan Bi <dandan.bi@intel.com>;
> > Liming Gao <gaoliming@byosoft.com.cn>
> > 主题: [edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3
> > ResumeCount
> >
> > From: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677
> >
> > Attacker able to modify physical memory and ResumeCount.
> > System will crash/DoS when ResumeCount reaches its MAX_UINT32.
> >
> > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > Cc: Dandan Bi <dandan.bi@intel.com>
> > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> >
> > Signed-off-by: Pakkirisamy ShanmugavelX
> > <shanmugavelx.pakkirisamy@intel.com>
> > ---
> >
> > MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePe
> > rformancePei.c | 14 +++++++++-----
> >  1 file changed, 9 insertions(+), 5 deletions(-)
> >
> > diff --git
> > a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > index 2f2b2a80b2..1035ed8640 100644
> > ---
> > a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > +++
> > b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > @@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei (
> >    //
> >    S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume,
> > AcpiS3ResumeRecord->ResumeCount);
> >    AcpiS3ResumeRecord->ResumeCount++;
> > -  AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> > AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> > -
> > -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount
> > = %d\n", AcpiS3ResumeRecord->ResumeCount));
> > -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume
> > = %ld\n", AcpiS3ResumeRecord->FullResume));
> > -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume
> > = %ld\n", AcpiS3ResumeRecord->AverageResume));
> > +  if (AcpiS3ResumeRecord->ResumeCount > 0) {
> > +    AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> > AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> > +    DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance -
> > AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
> > +  }
> > +  else {
> > +    DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the
> > MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
> > +  }
> > +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   =
> > 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
> > +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    =
> > 0x%x\n", AcpiS3ResumeRecord->FullResume));
> >
> >    //
> >    // Update S3 Suspend Performance Record.
> > --
> > 2.45.0.windows.1
> >
> >
> >
> > 
> >
> 
> 



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118891): https://edk2.groups.io/g/devel/message/118891
Mute This Topic: https://groups.io/mt/106097838/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-