From: "Yao, Jiewen" <jiewen.yao@intel.com>
To: "Wang, Jian J" <jian.j.wang@intel.com>,
"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "Zhang, Chao B" <chao.b.zhang@intel.com>
Subject: Re: [PATCH 5/9] SecurityPkg/DxeImageVerificationLib: refactor db/dbx fetching code in IsAllowedByDb(CVE-2019-14575)
Date: Thu, 13 Feb 2020 09:44:18 +0000 [thread overview]
Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F92CBC3@shsmsx102.ccr.corp.intel.com> (raw)
In-Reply-To: <20200206141933.356-6-jian.j.wang@intel.com>
Good enhancement.
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
> -----Original Message-----
> From: Wang, Jian J <jian.j.wang@intel.com>
> Sent: Thursday, February 6, 2020 10:19 PM
> To: devel@edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B
> <chao.b.zhang@intel.com>
> Subject: [PATCH 5/9] SecurityPkg/DxeImageVerificationLib: refactor db/dbx
> fetching code in IsAllowedByDb(CVE-2019-14575)
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608
>
> The dbx fetching code inside the while/for-loop causes code hard to
> understand. Since there's no need to get dbx more than once, this patch
> simplify the code logic by moving related code to be outside the while-
> loop. db fetching code is also refined accordingly to reduce the indent
> level of code.
>
> More comments are also added or refined to explain more details.
>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> ---
> .../DxeImageVerificationLib.c | 144 ++++++++++--------
> 1 file changed, 83 insertions(+), 61 deletions(-)
>
> diff --git
> a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> index ed5dbf26b0..8739d1fa29 100644
> --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> @@ -1412,76 +1412,92 @@ IsAllowedByDb (
> RootCertSize = 0;
>
> VerifyStatus = FALSE;
>
>
>
> + //
>
> + // Fetch 'db' content. If 'db' doesn't exist or encounters problem to get the
>
> + // data, return not-allowed-by-db (FALSE).
>
> + //
>
> DataSize = 0;
>
> Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE,
> &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
>
> - if (Status == EFI_BUFFER_TOO_SMALL) {
>
> - Data = (UINT8 *) AllocateZeroPool (DataSize);
>
> - if (Data == NULL) {
>
> - return VerifyStatus;
>
> + ASSERT (EFI_ERROR (Status));
>
> + if (Status != EFI_BUFFER_TOO_SMALL) {
>
> + return VerifyStatus;
>
> + }
>
> +
>
> + Data = (UINT8 *) AllocateZeroPool (DataSize);
>
> + if (Data == NULL) {
>
> + return VerifyStatus;
>
> + }
>
> +
>
> + Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE,
> &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);
>
> + if (EFI_ERROR (Status)) {
>
> + goto Done;
>
> + }
>
> +
>
> + //
>
> + // Fetch 'dbx' content. If 'dbx' doesn't exist, continue to check 'db'.
>
> + // If any other errors occured, no need to check 'db' but just return
>
> + // not-allowed-by-db (FALSE) to avoid bypass.
>
> + //
>
> + DbxDataSize = 0;
>
> + Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1,
> &gEfiImageSecurityDatabaseGuid, NULL, &DbxDataSize, NULL);
>
> + ASSERT (EFI_ERROR (Status));
>
> + if (Status != EFI_BUFFER_TOO_SMALL) {
>
> + if (Status != EFI_NOT_FOUND) {
>
> + goto Done;
>
> + }
>
> + //
>
> + // 'dbx' does not exist. Continue to check 'db'.
>
> + //
>
> + } else {
>
> + //
>
> + // 'dbx' exists. Get its content.
>
> + //
>
> + DbxData = (UINT8 *) AllocateZeroPool (DbxDataSize);
>
> + if (DbxData == NULL) {
>
> + goto Done;
>
> }
>
>
>
> - Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE,
> &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);
>
> + Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1,
> &gEfiImageSecurityDatabaseGuid, NULL, &DbxDataSize, (VOID *) DbxData);
>
> if (EFI_ERROR (Status)) {
>
> goto Done;
>
> }
>
> + }
>
>
>
> - //
>
> - // Find X509 certificate in Signature List to verify the signature in pkcs7 signed
> data.
>
> - //
>
> - CertList = (EFI_SIGNATURE_LIST *) Data;
>
> - while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
>
> - if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
>
> - CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof
> (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
>
> - CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) -
> CertList->SignatureHeaderSize) / CertList->SignatureSize;
>
> + //
>
> + // Find X509 certificate in Signature List to verify the signature in pkcs7 signed
> data.
>
> + //
>
> + CertList = (EFI_SIGNATURE_LIST *) Data;
>
> + while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
>
> + if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
>
> + CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof
> (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
>
> + CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) -
> CertList->SignatureHeaderSize) / CertList->SignatureSize;
>
>
>
> - for (Index = 0; Index < CertCount; Index++) {
>
> - //
>
> - // Iterate each Signature Data Node within this CertList for verify.
>
> - //
>
> - RootCert = CertData->SignatureData;
>
> - RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);
>
> + for (Index = 0; Index < CertCount; Index++) {
>
> + //
>
> + // Iterate each Signature Data Node within this CertList for verify.
>
> + //
>
> + RootCert = CertData->SignatureData;
>
> + RootCertSize = CertList->SignatureSize - sizeof (EFI_GUID);
>
>
>
> + //
>
> + // Call AuthenticodeVerify library to Verify Authenticode struct.
>
> + //
>
> + VerifyStatus = AuthenticodeVerify (
>
> + AuthData,
>
> + AuthDataSize,
>
> + RootCert,
>
> + RootCertSize,
>
> + mImageDigest,
>
> + mImageDigestSize
>
> + );
>
> + if (VerifyStatus) {
>
> //
>
> - // Call AuthenticodeVerify library to Verify Authenticode struct.
>
> + // The image is signed and its signature is found in 'db'.
>
> //
>
> - VerifyStatus = AuthenticodeVerify (
>
> - AuthData,
>
> - AuthDataSize,
>
> - RootCert,
>
> - RootCertSize,
>
> - mImageDigest,
>
> - mImageDigestSize
>
> - );
>
> - if (VerifyStatus) {
>
> + if (DbxData != NULL) {
>
> //
>
> // Here We still need to check if this RootCert's Hash is revoked
>
> //
>
> - DbxDataSize = 0;
>
> - Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1,
> &gEfiImageSecurityDatabaseGuid, NULL, &DbxDataSize, NULL);
>
> - if (Status != EFI_BUFFER_TOO_SMALL) {
>
> - if (Status != EFI_NOT_FOUND) {
>
> - VerifyStatus = FALSE;
>
> - }
>
> - goto Done;
>
> - }
>
> - DbxData = (UINT8 *) AllocateZeroPool (DbxDataSize);
>
> - if (DbxData == NULL) {
>
> - //
>
> - // Force not-allowed-by-db to avoid bypass
>
> - //
>
> - VerifyStatus = FALSE;
>
> - goto Done;
>
> - }
>
> -
>
> - Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1,
> &gEfiImageSecurityDatabaseGuid, NULL, &DbxDataSize, (VOID *) DbxData);
>
> - if (EFI_ERROR (Status)) {
>
> - //
>
> - // Force not-allowed-by-db to avoid bypass
>
> - //
>
> - VerifyStatus = FALSE;
>
> - goto Done;
>
> - }
>
> -
>
> if (IsCertHashFoundInDatabase (RootCert, RootCertSize,
> (EFI_SIGNATURE_LIST *)DbxData, DbxDataSize, &RevocationTime)) {
>
> //
>
> // Check the timestamp signature and signing time to determine if the
> RootCert can be trusted.
>
> @@ -1491,17 +1507,23 @@ IsAllowedByDb (
> DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed and
> signature is accepted by DB, but its root cert failed the timestamp check.\n"));
>
> }
>
> }
>
> -
>
> - goto Done;
>
> }
>
>
>
> - CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertData + CertList-
> >SignatureSize);
>
> + //
>
> + // There's no 'dbx' to check revocation time against (must-be pass),
>
> + // or, there's revocation time found in 'dbx' and checked againt 'dbt'
>
> + // (maybe pass or fail, depending on timestamp compare result). Either
>
> + // way the verification job has been completed at this point.
>
> + //
>
> + goto Done;
>
> }
>
> - }
>
>
>
> - DataSize -= CertList->SignatureListSize;
>
> - CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList-
> >SignatureListSize);
>
> + CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertData + CertList-
> >SignatureSize);
>
> + }
>
> }
>
> +
>
> + DataSize -= CertList->SignatureListSize;
>
> + CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList-
> >SignatureListSize);
>
> }
>
>
>
> Done:
>
> --
> 2.24.0.windows.2
next prev parent reply other threads:[~2020-02-13 9:44 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-06 14:19 [PATCH 0/9] Fix false negative issue in DxeImageVerificationHandler Wang, Jian J
2020-02-06 14:19 ` [PATCH 1/9] SecurityPkg/DxeImageVerificationLib: Fix memory leaks(CVE-2019-14575) Wang, Jian J
2020-02-13 9:34 ` Yao, Jiewen
2020-02-13 16:43 ` [edk2-devel] " Philippe Mathieu-Daudé
2020-02-06 14:19 ` [PATCH 2/9] SecurityPkg/DxeImageVerificationLib: reject CertStack.CertNumber==0 per DBX(CVE-2019-14575) Wang, Jian J
2020-02-13 9:36 ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 3/9] SecurityPkg/DxeImageVerificationLib: fix wrong fetching dbx in IsAllowedByDb(CVE-2019-14575) Wang, Jian J
2020-02-13 9:38 ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 4/9] SecurityPkg/DxeImageVerificationLib: avoid bypass in " Wang, Jian J
2020-02-13 9:39 ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 5/9] SecurityPkg/DxeImageVerificationLib: refactor db/dbx fetching code " Wang, Jian J
2020-02-13 9:44 ` Yao, Jiewen [this message]
2020-02-06 14:19 ` [PATCH 6/9] SecurityPkg/DxeImageVerificationLib: Differentiate error and search result in IsCertHashFoundInDatabase(CVE-2019-14575) Wang, Jian J
2020-02-13 10:11 ` Yao, Jiewen
2020-02-13 15:07 ` Wang, Jian J
2020-02-14 0:54 ` Yao, Jiewen
2020-02-14 3:31 ` Wang, Jian J
2020-02-14 3:33 ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 7/9] SecurityPkg/DxeImageVerificationLib: tighten default result of IsForbiddenByDbx()(CVE-2019-14575) Wang, Jian J
2020-02-13 10:13 ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 8/9] SecurityPkg/DxeImageVerificationLib: plug Data leak in IsForbiddenByDbx()(CVE-2019-14575) Wang, Jian J
2020-02-13 10:14 ` Yao, Jiewen
2020-02-13 16:56 ` [edk2-devel] " Philippe Mathieu-Daudé
2020-02-06 14:19 ` [PATCH 9/9] SecurityPkg/DxeImageVerificationLib: Differentiate error and search result in IsSignatureFoundInDatabase(CVE-2019-14575) Wang, Jian J
2020-02-13 9:02 ` [edk2-devel] " Zhang, Chao B
2020-02-13 10:20 ` Yao, Jiewen
2020-02-13 1:53 ` [edk2-devel] [PATCH 0/9] Fix false negative issue in DxeImageVerificationHandler Liming Gao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=74D8A39837DF1E4DA445A8C0B3885C503F92CBC3@shsmsx102.ccr.corp.intel.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox