From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.groups.io with SMTP id smtpd.web10.16538.1679324436269832607 for ; Mon, 20 Mar 2023 08:00:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=NOKk3XXO; spf=pass (domain: redhat.com, ip: 170.10.133.124, mailfrom: kraxel@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1679324435; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bDQZMaZUWPYiRR52Cz1/Ij7R6A6dxddXbkPmQtnsNWM=; b=NOKk3XXOq+/YAyhK69NjcR9IPdCsB9u4zrj0Ij837KLTqdTvHn2s3iLgqgpBKwAcLZ6f/n Lx/xrXWoq5dqAJ94aabR3++QKZ8QBzzKqp5E9XEH90++0BvXUMS2YFqzxRjplC0Jq359F3 eGyH41wd5FzXr7B74/C4J4Yy1YX1r3E= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-78-3MKdaHMhOVKXH507lFH1Eg-1; Mon, 20 Mar 2023 11:00:31 -0400 X-MC-Unique: 3MKdaHMhOVKXH507lFH1Eg-1 Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 59A63100DEAD; Mon, 20 Mar 2023 15:00:15 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.39.192.144]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 2B4B24021B1; Mon, 20 Mar 2023 15:00:15 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id CE6341800081; Mon, 20 Mar 2023 16:00:13 +0100 (CET) Date: Mon, 20 Mar 2023 16:00:13 +0100 From: "Gerd Hoffmann" To: devel@edk2.groups.io, jiewen.yao@intel.com Cc: Pawel Polawski , "Wang, Jian J" , Oliver Steffen , "Xu, Min M" , Marvin =?utf-8?Q?H=C3=A4user?= , "jmaloy@redhat.com" Subject: Re: [edk2-devel] [PATCH v2 1/1] SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2 Message-ID: <20230320150013.ykcaxygkburz4m2s@sirius.home.kraxel.org> References: <20230303103553.804781-1-kraxel@redhat.com> <20230320100208.xhoz7smo5fkhal26@sirius.home.kraxel.org> MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 3.1 on 10.11.54.10 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit On Mon, Mar 20, 2023 at 01:20:29PM +0000, Yao, Jiewen wrote: > Would you please share with us what test has been done for this patch? Usual regression testing, including booting images with and without secure boot. Additionally checked images with the wrong signature are rejected (try boot grub.efi directly instead of using the shim.efi -> grub.efi chain). take care, Gerd > > Thank you > Yao, Jiewen > > > -----Original Message----- > > From: devel@edk2.groups.io On Behalf Of Gerd > > Hoffmann > > Sent: Monday, March 20, 2023 6:02 PM > > To: devel@edk2.groups.io > > Cc: Pawel Polawski ; Wang, Jian J > > ; Oliver Steffen ; Xu, Min M > > ; Marvin Häuser ; Yao, > > Jiewen ; jmaloy@redhat.com > > Subject: Re: [edk2-devel] [PATCH v2 1/1] > > SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2 > > > > On Fri, Mar 03, 2023 at 11:35:53AM +0100, Gerd Hoffmann wrote: > > > Call gRT->GetVariable() directly to read the SecureBoot variable. It is > > > one byte in size so we can easily place it on the stack instead of > > > having GetEfiGlobalVariable2() allocate it for us, which avoids a few > > > possible error cases. > > > > > > Skip secure boot checks if (and only if): > > > > > > (a) the SecureBoot variable is not present (EFI_NOT_FOUND) according to > > > the return value, or > > > (b) the SecureBoot variable was read successfully and is set to > > > SECURE_BOOT_MODE_DISABLE. > > > > > > Previously the code skipped the secure boot checks on *any* > > > gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable > > > value to NULL in that case) and also on memory allocation failures. > > > > > > Fixes: CVE-2019-14560 > > > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=2167 > > > Signed-off-by: Gerd Hoffmann > > > > Ping. Any comments on this patch? > > > > take care, > > Gerd > > > > > > > > > > > > > > > > --