From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 97645940E67 for ; Fri, 12 Jan 2024 02:25:36 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=5snHfxfjdsBwDcnCCNJMq6R07FhiWyCsm8NPH2yl6Vs=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1705026335; v=1; b=UBdFJ8/oMXbBKVlY1yROzBM4JpjepaiBu4V+HuU0DGqu/6f/wBVhaNaczu5FCpqBOwFnSrRC qlTojOjorXEGV3oKU2MwG3TYB6qjziDyCMkactSJNMQtXW/uLrv1EIbU69b1Bj/wPhIH5oVIPzM SKlFlKsMidjts8htv9tF5mqA= X-Received: by 127.0.0.2 with SMTP id tuIoYY7687511x6uNkgHfJDn; Thu, 11 Jan 2024 18:25:35 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.10]) by mx.groups.io with SMTP id smtpd.web10.10549.1705026332442297960 for ; Thu, 11 Jan 2024 18:25:34 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10950"; a="6423565" X-IronPort-AV: E=Sophos;i="6.04,188,1695711600"; d="scan'208";a="6423565" X-Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmvoesa104.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Jan 2024 18:25:34 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10950"; a="873233182" X-IronPort-AV: E=Sophos;i="6.04,188,1695711600"; d="scan'208";a="873233182" X-Received: from gguo-desk.gar.corp.intel.com ([10.225.76.26]) by FMSMGA003.fm.intel.com with ESMTP; 11 Jan 2024 18:25:28 -0800 From: "Guo, Gua" To: devel@edk2.groups.io Cc: gua.guo@intel.com, Marc Beatove , Guo Dong , Sean Rhodes , James Lu , John Mathew , Gerd Hoffmann Subject: [edk2-devel] [PATCH v3 1/4] UefiPayloadPkg/Hob: Integer Overflow in CreateHob() Date: Fri, 12 Jan 2024 10:25:17 +0800 Message-Id: <20240112022521.710-2-gua.guo@intel.com> In-Reply-To: <20240112022521.710-1-gua.guo@intel.com> References: <20240112022521.710-1-gua.guo@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gua.guo@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: tx30uN5uRhoa0H60eCkzG6mex7686176AA= Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b="UBdFJ8/o"; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io From: Gua Guo REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4166 Fix integer overflow in various CreateHob instances. Fixes: CVE-2022-36765 The CreateHob() function aligns the requested size to 8 performing the following operation: ``` HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); ``` No checks are performed to ensure this value doesn't overflow, and could lead to CreateHob() returning a smaller HOB than requested, which could lead to OOB HOB accesses. Reported-by: Marc Beatove Cc: Guo Dong Cc: Sean Rhodes Cc: James Lu Reviewed-by: Gua Guo Cc: John Mathew Authored-by: Gerd Hoffmann Signed-off-by: Gua Guo --- .../Library/PayloadEntryHobLib/Hob.c | 43 +++++++++++++++++++ .../FitUniversalPayloadEntry.c | 8 ++-- .../UefiPayloadEntry/UniversalPayloadEntry.c | 8 ++-- 3 files changed, 53 insertions(+), 6 deletions(-) diff --git a/UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c b/UefiPayloadP= kg/Library/PayloadEntryHobLib/Hob.c index 2c3acbbc19..51c2e28d7d 100644 --- a/UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c +++ b/UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c @@ -110,6 +110,13 @@ CreateHob ( =0D HandOffHob =3D GetHobList ();=0D =0D + //=0D + // Check Length to avoid data overflow.=0D + //=0D + if (HobLength > MAX_UINT16 - 0x7) {=0D + return NULL;=0D + }=0D +=0D HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7));=0D =0D FreeMemory =3D HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryB= ottom;=0D @@ -160,6 +167,9 @@ BuildResourceDescriptorHob ( =0D Hob =3D CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RES= OURCE_DESCRIPTOR));=0D ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D Hob->ResourceType =3D ResourceType;=0D Hob->ResourceAttribute =3D ResourceAttribute;=0D @@ -330,6 +340,10 @@ BuildModuleHob ( );=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMOR= Y_ALLOCATION_MODULE));=0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModule= Guid);=0D Hob->MemoryAllocationHeader.MemoryBaseAddress =3D MemoryAllocationModule= ;=0D @@ -378,6 +392,11 @@ BuildGuidHob ( ASSERT (DataLength <=3D (0xffff - sizeof (EFI_HOB_GUID_TYPE)));=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB= _GUID_TYPE) + DataLength));=0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return NULL;=0D + }=0D +=0D CopyGuid (&Hob->Name, Guid);=0D return Hob + 1;=0D }=0D @@ -441,6 +460,10 @@ BuildFvHob ( EFI_HOB_FIRMWARE_VOLUME *Hob;=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));=0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D Hob->BaseAddress =3D BaseAddress;=0D Hob->Length =3D Length;=0D @@ -472,6 +495,10 @@ BuildFv2Hob ( EFI_HOB_FIRMWARE_VOLUME2 *Hob;=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));= =0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D Hob->BaseAddress =3D BaseAddress;=0D Hob->Length =3D Length;=0D @@ -513,6 +540,10 @@ BuildFv3Hob ( EFI_HOB_FIRMWARE_VOLUME3 *Hob;=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_FV3, sizeof (EFI_HOB_FIRMWARE_VOLUME3));= =0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D Hob->BaseAddress =3D BaseAddress;=0D Hob->Length =3D Length;=0D @@ -546,6 +577,10 @@ BuildCpuHob ( EFI_HOB_CPU *Hob;=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));=0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D Hob->SizeOfMemorySpace =3D SizeOfMemorySpace;=0D Hob->SizeOfIoSpace =3D SizeOfIoSpace;=0D @@ -583,6 +618,10 @@ BuildStackHob ( );=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMOR= Y_ALLOCATION_STACK));=0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D CopyGuid (&(Hob->AllocDescriptor.Name), &gEfiHobMemoryAllocStackGuid);=0D Hob->AllocDescriptor.MemoryBaseAddress =3D BaseAddress;=0D @@ -664,6 +703,10 @@ BuildMemoryAllocationHob ( );=0D =0D Hob =3D CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMOR= Y_ALLOCATION));=0D + ASSERT (Hob !=3D NULL);=0D + if (Hob =3D=3D NULL) {=0D + return;=0D + }=0D =0D ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));=0D Hob->AllocDescriptor.MemoryBaseAddress =3D BaseAddress;=0D diff --git a/UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c b/U= efiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c index d2e7df4fbe..eb0b325369 100644 --- a/UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c +++ b/UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c @@ -207,10 +207,12 @@ AddNewHob ( }=0D =0D NewHob.Header =3D CreateHob (Hob->Header->HobType, Hob->Header->HobLengt= h);=0D -=0D - if (NewHob.Header !=3D NULL) {=0D - CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - = sizeof (EFI_HOB_GENERIC_HEADER));=0D + ASSERT (NewHob.Header !=3D NULL);=0D + if (NewHob.Header =3D=3D NULL) {=0D + return;=0D }=0D +=0D + CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - si= zeof (EFI_HOB_GENERIC_HEADER));=0D }=0D =0D /**=0D diff --git a/UefiPayloadPkg/UefiPayloadEntry/UniversalPayloadEntry.c b/Uefi= PayloadPkg/UefiPayloadEntry/UniversalPayloadEntry.c index f8939efe70..f37c00fad7 100644 --- a/UefiPayloadPkg/UefiPayloadEntry/UniversalPayloadEntry.c +++ b/UefiPayloadPkg/UefiPayloadEntry/UniversalPayloadEntry.c @@ -111,10 +111,12 @@ AddNewHob ( }=0D =0D NewHob.Header =3D CreateHob (Hob->Header->HobType, Hob->Header->HobLengt= h);=0D -=0D - if (NewHob.Header !=3D NULL) {=0D - CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - = sizeof (EFI_HOB_GENERIC_HEADER));=0D + ASSERT (NewHob.Header !=3D NULL);=0D + if (NewHob.Header =3D=3D NULL) {=0D + return;=0D }=0D +=0D + CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - si= zeof (EFI_HOB_GENERIC_HEADER));=0D }=0D =0D /**=0D --=20 2.39.2.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113640): https://edk2.groups.io/g/devel/message/113640 Mute This Topic: https://groups.io/mt/103675960/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-