public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* [patch] MdeModulePkg/HiiDB: Remove configuration table when it's freed (CVE-2019-14586)
@ 2020-02-13  4:03 Dandan Bi
  2020-02-13  4:03 ` [patch 1/2] MdeModulePkg/String.c: Zero memory before free (CVE-2019-14558) Dandan Bi
                   ` (2 more replies)
  0 siblings, 3 replies; 8+ messages in thread
From: Dandan Bi @ 2020-02-13  4:03 UTC (permalink / raw)
  To: devel; +Cc: Liming Gao, Eric Dong, Jian J Wang

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1995

Fix the corner case issue that the original configuration runtime
memory is freed, but it is still exposed to the OS runtime.
So this patch is to remove the configuration table to avoid being
used in OS runtime when the configuration runtime memory is freed.

Cc: Liming Gao <liming.gao@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Dandan Bi <dandan.bi@intel.com>
Reviewed-by: Eric Dong <eric.dong@intel.com>
---
 MdeModulePkg/Universal/HiiDatabaseDxe/Database.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/MdeModulePkg/Universal/HiiDatabaseDxe/Database.c b/MdeModulePkg/Universal/HiiDatabaseDxe/Database.c
index d3791ca68b..36265b8ff9 100644
--- a/MdeModulePkg/Universal/HiiDatabaseDxe/Database.c
+++ b/MdeModulePkg/Universal/HiiDatabaseDxe/Database.c
@@ -3374,10 +3374,14 @@ HiiGetConfigRespInfo(
       }
       gRTConfigRespBuffer = (EFI_STRING) AllocateRuntimeZeroPool (gConfigRespSize);
       if (gRTConfigRespBuffer == NULL){
         FreePool(ConfigAltResp);
         DEBUG ((DEBUG_ERROR, "[HiiDatabase]: No enough memory resource to store the ConfigResp string.\n"));
+        //
+        // Remove from the System Table when the configuration runtime buffer is freed.
+        //
+        gBS->InstallConfigurationTable (&gEfiHiiConfigRoutingProtocolGuid, NULL);
         return EFI_OUT_OF_RESOURCES;
       }
     } else {
       ZeroMem(gRTConfigRespBuffer,gConfigRespSize);
     }
@@ -3429,10 +3433,14 @@ HiiGetDatabaseInfo(
       DEBUG ((DEBUG_WARN, "[HiiDatabase]: Memory allocation is required after ReadyToBoot, which may change memory map and cause S4 resume issue.\n"));
     }
     gRTDatabaseInfoBuffer = AllocateRuntimeZeroPool (gDatabaseInfoSize);
     if (gRTDatabaseInfoBuffer == NULL){
       DEBUG ((DEBUG_ERROR, "[HiiDatabase]: No enough memory resource to store the HiiDatabase info.\n"));
+      //
+      // Remove from the System Table when the configuration runtime buffer is freed.
+      //
+      gBS->InstallConfigurationTable (&gEfiHiiDatabaseProtocolGuid, NULL);
       return EFI_OUT_OF_RESOURCES;
     }
   } else {
     ZeroMem(gRTDatabaseInfoBuffer,gDatabaseInfoSize);
   }
-- 
2.18.0.windows.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-02-14  6:45 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-02-13  4:03 [patch] MdeModulePkg/HiiDB: Remove configuration table when it's freed (CVE-2019-14586) Dandan Bi
2020-02-13  4:03 ` [patch 1/2] MdeModulePkg/String.c: Zero memory before free (CVE-2019-14558) Dandan Bi
2020-02-13  4:06   ` Wang, Jian J
2020-02-14  6:44   ` Dong, Eric
2020-02-13  4:03 ` [patch 2/2] MdeModulePkg/DisplayEngine: " Dandan Bi
2020-02-13  4:11   ` Wang, Jian J
2020-02-14  6:45   ` Dong, Eric
2020-02-13  4:05 ` [patch] MdeModulePkg/HiiDB: Remove configuration table when it's freed (CVE-2019-14586) Wang, Jian J

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox