From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 46692AC0AD1 for ; Thu, 11 Jan 2024 05:15:46 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=8BUPiYQoaAvHwLgZfKX4Jgjq0pvPQxo9n9ZIuFm+p/A=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1704950144; v=1; b=aNmBFrrNvDa01mGpH8kyGdrAkKpqcb/zXWxzNgs0XFnltaCXBAICqY6Mmm/TTTsg00GwN4RI uysR9+Wy6QAWLjcOd69EWcMD4pD3kvkXB1MQYOcXnyLnkMR5Jfd0l+rJuTKyo/3X05y+lrBL9PS LdOk0npFiMVhnX0iVa5gL4Hg= X-Received: by 127.0.0.2 with SMTP id e3xnYY7687511xbSyIn8Rjhp; Wed, 10 Jan 2024 21:15:44 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) by mx.groups.io with SMTP id smtpd.web10.5391.1704950130183224811 for ; Wed, 10 Jan 2024 21:15:39 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="12229136" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="12229136" X-Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jan 2024 21:15:38 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="955624855" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="955624855" X-Received: from gguo-desk.gar.corp.intel.com ([10.225.76.26]) by orsmga005.jf.intel.com with ESMTP; 10 Jan 2024 21:15:36 -0800 From: "Guo, Gua" To: devel@edk2.groups.io Cc: gua.guo@intel.com, Gerd Hoffmann , Marc Beatove , Liming Gao , John Mathew Subject: [edk2-devel] [PATCH v1 4/4] MdeModulePkg/Hob: Integer Overflow in CreateHob() Date: Thu, 11 Jan 2024 13:15:21 +0800 Message-Id: <20240111051521.1366-5-gua.guo@intel.com> In-Reply-To: <20240111051521.1366-1-gua.guo@intel.com> References: <20240111051521.1366-1-gua.guo@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gua.guo@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: cGHlQXBtEfuCAfLPrqpt9jY9x7686176AA= Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=aNmBFrrN; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io From: Gerd Hoffmann REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4166 Fix integer overflow in various CreateHob instances. Fixes: CVE-2022-36765 The CreateHob() function aligns the requested size to 8 performing the following operation: ``` HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); ``` No checks are performed to ensure this value doesn't overflow, and could lead to CreateHob() returning a smaller HOB than requested, which could lead to OOB HOB accesses. Reported-by: Marc Beatove Cc: Liming Gao Cc: John Mathew Signed-off-by: Gerd Hoffmann --- MdeModulePkg/Core/Pei/Hob/Hob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MdeModulePkg/Core/Pei/Hob/Hob.c b/MdeModulePkg/Core/Pei/Hob/Ho= b.c index c4882a23cd..985da50995 100644 --- a/MdeModulePkg/Core/Pei/Hob/Hob.c +++ b/MdeModulePkg/Core/Pei/Hob/Hob.c @@ -85,7 +85,7 @@ PeiCreateHob ( //=0D // Check Length to avoid data overflow.=0D //=0D - if (0x10000 - Length <=3D 0x7) {=0D + if (MAX_UINT16 - Length < 0x7) {=0D return EFI_INVALID_PARAMETER;=0D }=0D =0D --=20 2.39.2.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113580): https://edk2.groups.io/g/devel/message/113580 Mute This Topic: https://groups.io/mt/103657274/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-