From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id D6220941476 for ; Wed, 8 May 2024 07:35:42 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=TkB+wnYpD8JTBdhitEBOoIbrYif7M7X+y/G9zD0hy30=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20240206; t=1715153741; v=1; b=hamd9UBypQge0egltMtqMfL8TDVLUfNiiY0IxZgD6IZ53U/IwqIzakNT731lqard/IMTpf6y 8Ut93wK6/w+iugGVRdsncBYiFMPUU7qXAzmZ6IMd8KtPO+JVqKUCfz1t49YaeIhxm4+SwDF/LMw bfmNZBNbvi7J4MYmNYo6qPGwonROp8AbUxjezLVVPlHbcLSNmos9P0VHwTnmiBgI9C3KoNA+PGW b8AzKP6Ftft63oTSpEoXppH+fSXm0cM7Bv3hR7uf1LLO84xezH652HxPm5J+A1t4XVPKe+ifbSm wOwDc0SOso0OUBWbKZUENkFthIWtPb20CLINoOhBmR/KQ== X-Received: by 127.0.0.2 with SMTP id lCz5YY7687511xey16KgjDAi; Wed, 08 May 2024 00:35:41 -0700 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.7]) by mx.groups.io with SMTP id smtpd.web11.16793.1714989202279783411 for ; Mon, 06 May 2024 02:53:22 -0700 X-CSE-ConnectionGUID: LhMIjuWOSzOOr36tcpUfeQ== X-CSE-MsgGUID: tthRw6mvR5iwnZS3Biz6Cg== X-IronPort-AV: E=McAfee;i="6600,9927,11064"; a="36113825" X-IronPort-AV: E=Sophos;i="6.07,258,1708416000"; d="scan'208";a="36113825" X-Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by fmvoesa101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 May 2024 02:53:22 -0700 X-CSE-ConnectionGUID: 545JDl5rQyS0zKBhw+o27g== X-CSE-MsgGUID: K8+ey7FDSmWfGqTuWESvEQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.07,258,1708416000"; d="scan'208";a="28210865" X-Received: from spakki1x-mobl1.gar.corp.intel.com ([10.215.115.190]) by fmviesa010-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 May 2024 02:53:19 -0700 From: "Pakkirisamy ShanmugavelX" To: devel@edk2.groups.io Cc: Shanmugavel Pakkirisamy , Zhiguang Liu , Dandan Bi , Liming Gao Subject: [edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount Date: Mon, 6 May 2024 15:23:09 +0530 Message-ID: <20240506095309.842-1-shanmugavelx.pakkirisamy@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Wed, 08 May 2024 00:35:40 -0700 Resent-From: shanmugavelx.pakkirisamy@intel.com Reply-To: devel@edk2.groups.io,shanmugavelx.pakkirisamy@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: redjMErkWvsZOMTkyd6xjBgNx7686176AA= Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=hamd9UBy; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io From: Shanmugavel Pakkirisamy REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677 Attacker able to modify physical memory and ResumeCount. System will crash/DoS when ResumeCount reaches its MAX_UINT32. Cc: Zhiguang Liu Cc: Dandan Bi Cc: Liming Gao Signed-off-by: Pakkirisamy ShanmugavelX --- MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c index 2f2b2a80b2..1035ed8640 100644 --- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c +++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c @@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei ( // S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, AcpiS3ResumeRecord->ResumeCount); AcpiS3ResumeRecord->ResumeCount++; - AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); - - DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount = %d\n", AcpiS3ResumeRecord->ResumeCount)); - DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume = %ld\n", AcpiS3ResumeRecord->FullResume)); - DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume = %ld\n", AcpiS3ResumeRecord->AverageResume)); + if (AcpiS3ResumeRecord->ResumeCount > 0) { + AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); + DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance - AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume)); + } + else { + DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the MAX_UINT32 value. S3 ResumeCount record reset to Zero.")); + } + DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount = 0x%x\n", AcpiS3ResumeRecord->ResumeCount)); + DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume = 0x%x\n", AcpiS3ResumeRecord->FullResume)); // // Update S3 Suspend Performance Record. -- 2.45.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118659): https://edk2.groups.io/g/devel/message/118659 Mute This Topic: https://groups.io/mt/105977011/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-