From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga12.intel.com (mga12.intel.com []) by mx.groups.io with SMTP id smtpd.web12.2682.1594259811903593619 for ; Wed, 08 Jul 2020 18:57:07 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=fail (domain: intel.com, ip: , mailfrom: guomin.jiang@intel.com) IronPort-SDR: hkn7tr05mo6bd+ib1J0tKvrqTl7fjiHBUKa0JNjozdbj6DHBnz1YwTvNNwh+1Tz/G3pM7+1dc2 jXvXitAN9X9g== X-IronPort-AV: E=McAfee;i="6000,8403,9676"; a="127511783" X-IronPort-AV: E=Sophos;i="5.75,330,1589266800"; d="scan'208";a="127511783" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Jul 2020 18:57:07 -0700 IronPort-SDR: mSeeS/3jaBK/D4+YfvCzg9NiezwffRpM50szi+/9UxfewmsmPX/9SgILcKmua4RTjlp3rFyVGI ubUymGJs+sBw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.75,330,1589266800"; d="scan'208";a="483615438" Received: from guominji-mobl.ccr.corp.intel.com ([10.238.4.95]) by fmsmga006.fm.intel.com with ESMTP; 08 Jul 2020 18:57:05 -0700 From: "Guomin Jiang" To: devel@edk2.groups.io Cc: Eric Dong , Ray Ni , Laszlo Ersek , Rahul Kumar Subject: [PATCH v5 7/9] UefiCpuPkg/CpuMpPei: Enable paging and set NP flag to avoid TOCTOU (CVE-2019-11098) Date: Thu, 9 Jul 2020 09:56:43 +0800 Message-Id: <20200709015645.336-8-guomin.jiang@intel.com> X-Mailer: git-send-email 2.25.1.windows.1 In-Reply-To: <20200709015645.336-1-guomin.jiang@intel.com> References: <20200709015645.336-1-guomin.jiang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614 To avoid the TOCTOU, enable paging and set Not Present flag so when access any code in the flash range, it will trigger #NP exception. Cc: Eric Dong Cc: Ray Ni Cc: Laszlo Ersek Cc: Rahul Kumar Signed-off-by: Guomin Jiang Acked-by: Laszlo Ersek --- UefiCpuPkg/CpuMpPei/CpuMpPei.inf | 3 +++ UefiCpuPkg/CpuMpPei/CpuPaging.c | 26 ++++++++++++++++++++++++-- 2 files changed, 27 insertions(+), 2 deletions(-) diff --git a/UefiCpuPkg/CpuMpPei/CpuMpPei.inf b/UefiCpuPkg/CpuMpPei/CpuMpPei.inf index f4d11b861f77..7e511325d8b8 100644 --- a/UefiCpuPkg/CpuMpPei/CpuMpPei.inf +++ b/UefiCpuPkg/CpuMpPei/CpuMpPei.inf @@ -46,6 +46,9 @@ [LibraryClasses] BaseMemoryLib CpuLib +[Guids] + gEdkiiMigratedFvInfoGuid ## SOMETIMES_CONSUMES ## HOB + [Ppis] gEfiPeiMpServicesPpiGuid ## PRODUCES gEfiSecPlatformInformationPpiGuid ## SOMETIMES_CONSUMES diff --git a/UefiCpuPkg/CpuMpPei/CpuPaging.c b/UefiCpuPkg/CpuMpPei/CpuPaging.c index 3bf0574b34c6..04a16fb2b620 100644 --- a/UefiCpuPkg/CpuMpPei/CpuPaging.c +++ b/UefiCpuPkg/CpuMpPei/CpuPaging.c @@ -12,6 +12,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include #include #include +#include #include "CpuMpPei.h" @@ -605,6 +606,8 @@ MemoryDiscoveredPpiNotifyCallback ( EFI_STATUS Status; BOOLEAN InitStackGuard; BOOLEAN InterruptState; + EDKII_MIGRATED_FV_INFO *MigratedFvInfo; + EFI_PEI_HOB_POINTERS Hob; if (PcdGetBool (PcdMigrateTemporaryRamFirmwareVolumes)) { InterruptState = SaveAndDisableInterrupts (); @@ -619,9 +622,14 @@ MemoryDiscoveredPpiNotifyCallback ( // the task switch (for the sake of stack switch). // InitStackGuard = FALSE; - if (IsIa32PaeSupported () && PcdGetBool (PcdCpuStackGuard)) { + Hob.Raw = NULL; + if (IsIa32PaeSupported ()) { + Hob.Raw = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid); + InitStackGuard = PcdGetBool (PcdCpuStackGuard); + } + + if (InitStackGuard || Hob.Raw != NULL) { EnablePaging (); - InitStackGuard = TRUE; } Status = InitializeCpuMpWorker ((CONST EFI_PEI_SERVICES **)PeiServices); @@ -631,6 +639,20 @@ MemoryDiscoveredPpiNotifyCallback ( SetupStackGuardPage (); } + while (Hob.Raw != NULL) { + MigratedFvInfo = GET_GUID_HOB_DATA (Hob); + + // + // Enable #NP exception, so if the code access after disable NEM, it will generate + // to avoid potential vulnerability. + // + ConvertMemoryPageAttributes (MigratedFvInfo->FvOrgBase, MigratedFvInfo->FvLength, 0); + + Hob.Raw = GET_NEXT_HOB (Hob); + Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw); + } + CpuFlushTlb (); + return Status; } -- 2.25.1.windows.1