public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Yao, Jiewen" <jiewen.yao@intel.com>
To: "Wang, Jian J" <jian.j.wang@intel.com>,
	"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "Zhang, Chao B" <chao.b.zhang@intel.com>
Subject: Re: [PATCH 9/9] SecurityPkg/DxeImageVerificationLib: Differentiate error and search result in IsSignatureFoundInDatabase(CVE-2019-14575)
Date: Thu, 13 Feb 2020 10:20:17 +0000	[thread overview]
Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F92CCE5@shsmsx102.ccr.corp.intel.com> (raw)
In-Reply-To: <20200206141933.356-10-jian.j.wang@intel.com>

Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>

> -----Original Message-----
> From: Wang, Jian J <jian.j.wang@intel.com>
> Sent: Thursday, February 6, 2020 10:20 PM
> To: devel@edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B
> <chao.b.zhang@intel.com>
> Subject: [PATCH 9/9] SecurityPkg/DxeImageVerificationLib: Differentiate error
> and search result in IsSignatureFoundInDatabase(CVE-2019-14575)
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608
> 
> To avoid false-negative issue in check hash against dbx, both error
> condition (as return value) and check result (as out parameter) of
> IsSignatureFoundInDatabase() are added. So the caller of this function
> will know exactly if a failure is caused by a black list hit or
> other error happening, and enforce a more secure operation to prevent
> secure boot from being bypassed. For a white list check (db), there's
> no such necessity.
> 
> All intermediate results inside this function will be checked and
> returned immediately upon any failure or error, like out-of-resource,
> hash calculation error or certificate retrieval failure.
> 
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
> ---
>  .../DxeImageVerificationLib.c                 | 77 ++++++++++++++-----
>  1 file changed, 58 insertions(+), 19 deletions(-)
> 
> diff --git
> a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> index 5b7a67f811..8e599ca0be 100644
> --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> @@ -955,17 +955,19 @@ Done:
>    @param[in]  Signature           Pointer to signature that is searched for.
> 
>    @param[in]  CertType            Pointer to hash algorithm.
> 
>    @param[in]  SignatureSize       Size of Signature.
> 
> +  @param[out] IsFound             Search result. Only valid if EFI_SUCCESS returned
> 
> 
> 
> -  @return TRUE                    Found the signature in the variable database.
> 
> -  @return FALSE                   Not found the signature in the variable database.
> 
> +  @retval EFI_SUCCESS             Finished the search without any error.
> 
> +  @retval Others                  Error occurred in the search of database.
> 
> 
> 
>  **/
> 
> -BOOLEAN
> 
> +EFI_STATUS
> 
>  IsSignatureFoundInDatabase (
> 
> -  IN CHAR16             *VariableName,
> 
> -  IN UINT8              *Signature,
> 
> -  IN EFI_GUID           *CertType,
> 
> -  IN UINTN              SignatureSize
> 
> +  IN  CHAR16            *VariableName,
> 
> +  IN  UINT8             *Signature,
> 
> +  IN  EFI_GUID          *CertType,
> 
> +  IN  UINTN             SignatureSize,
> 
> +  OUT BOOLEAN           *IsFound
> 
>    )
> 
>  {
> 
>    EFI_STATUS          Status;
> 
> @@ -975,22 +977,28 @@ IsSignatureFoundInDatabase (
>    UINT8               *Data;
> 
>    UINTN               Index;
> 
>    UINTN               CertCount;
> 
> -  BOOLEAN             IsFound;
> 
> 
> 
>    //
> 
>    // Read signature database variable.
> 
>    //
> 
> -  IsFound   = FALSE;
> 
> +  *IsFound  = FALSE;
> 
>    Data      = NULL;
> 
>    DataSize  = 0;
> 
>    Status    = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid,
> NULL, &DataSize, NULL);
> 
>    if (Status != EFI_BUFFER_TOO_SMALL) {
> 
> -    return FALSE;
> 
> +    if (Status == EFI_NOT_FOUND) {
> 
> +      //
> 
> +      // No database, no need to search.
> 
> +      //
> 
> +      Status = EFI_SUCCESS;
> 
> +    }
> 
> +
> 
> +    return Status;
> 
>    }
> 
> 
> 
>    Data = (UINT8 *) AllocateZeroPool (DataSize);
> 
>    if (Data == NULL) {
> 
> -    return FALSE;
> 
> +    return EFI_OUT_OF_RESOURCES;
> 
>    }
> 
> 
> 
>    Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid,
> NULL, &DataSize, Data);
> 
> @@ -1010,7 +1018,7 @@ IsSignatureFoundInDatabase (
>            //
> 
>            // Find the signature in database.
> 
>            //
> 
> -          IsFound = TRUE;
> 
> +          *IsFound = TRUE;
> 
>            //
> 
>            // Entries in UEFI_IMAGE_SECURITY_DATABASE that are used to validate
> image should be measured
> 
>            //
> 
> @@ -1023,7 +1031,7 @@ IsSignatureFoundInDatabase (
>          Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
> 
>        }
> 
> 
> 
> -      if (IsFound) {
> 
> +      if (*IsFound) {
> 
>          break;
> 
>        }
> 
>      }
> 
> @@ -1037,7 +1045,7 @@ Done:
>      FreePool (Data);
> 
>    }
> 
> 
> 
> -  return IsFound;
> 
> +  return Status;
> 
>  }
> 
> 
> 
>  /**
> 
> @@ -1642,6 +1650,8 @@ DxeImageVerificationHandler (
>    CHAR16                               *NameStr;
> 
>    RETURN_STATUS                        PeCoffStatus;
> 
>    EFI_STATUS                           HashStatus;
> 
> +  EFI_STATUS                           DbStatus;
> 
> +  BOOLEAN                              IsFound;
> 
> 
> 
>    SignatureList     = NULL;
> 
>    SignatureListSize = 0;
> 
> @@ -1650,7 +1660,7 @@ DxeImageVerificationHandler (
>    PkcsCertData      = NULL;
> 
>    Action            = EFI_IMAGE_EXECUTION_AUTH_UNTESTED;
> 
>    IsVerified        = FALSE;
> 
> -
> 
> +  IsFound           = FALSE;
> 
> 
> 
>    //
> 
>    // Check the image type and get policy setting.
> 
> @@ -1792,7 +1802,14 @@ DxeImageVerificationHandler (
>        goto Failed;
> 
>      }
> 
> 
> 
> -    if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1,
> mImageDigest, &mCertType, mImageDigestSize)) {
> 
> +    DbStatus = IsSignatureFoundInDatabase (
> 
> +                 EFI_IMAGE_SECURITY_DATABASE1,
> 
> +                 mImageDigest,
> 
> +                 &mCertType,
> 
> +                 mImageDigestSize,
> 
> +                 &IsFound
> 
> +                 );
> 
> +    if (EFI_ERROR (DbStatus) || IsFound) {
> 
>        //
> 
>        // Image Hash is in forbidden database (DBX).
> 
>        //
> 
> @@ -1800,7 +1817,14 @@ DxeImageVerificationHandler (
>        goto Failed;
> 
>      }
> 
> 
> 
> -    if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE,
> mImageDigest, &mCertType, mImageDigestSize)) {
> 
> +    DbStatus = IsSignatureFoundInDatabase (
> 
> +                 EFI_IMAGE_SECURITY_DATABASE,
> 
> +                 mImageDigest,
> 
> +                 &mCertType,
> 
> +                 mImageDigestSize,
> 
> +                 &IsFound
> 
> +                 );
> 
> +    if (!EFI_ERROR (DbStatus) && IsFound) {
> 
>        //
> 
>        // Image Hash is in allowed database (DB).
> 
>        //
> 
> @@ -1888,14 +1912,29 @@ DxeImageVerificationHandler (
>      //
> 
>      // Check the image's hash value.
> 
>      //
> 
> -    if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1,
> mImageDigest, &mCertType, mImageDigestSize)) {
> 
> +    DbStatus = IsSignatureFoundInDatabase (
> 
> +                 EFI_IMAGE_SECURITY_DATABASE1,
> 
> +                 mImageDigest,
> 
> +                 &mCertType,
> 
> +                 mImageDigestSize,
> 
> +                 &IsFound
> 
> +                 );
> 
> +    if (EFI_ERROR (DbStatus) || IsFound) {
> 
>        Action = EFI_IMAGE_EXECUTION_AUTH_SIG_FOUND;
> 
>        DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed but %s
> hash of image is found in DBX.\n", mHashTypeStr));
> 
>        IsVerified = FALSE;
> 
>        break;
> 
>      }
> 
> +
> 
>      if (!IsVerified) {
> 
> -      if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE,
> mImageDigest, &mCertType, mImageDigestSize)) {
> 
> +      DbStatus = IsSignatureFoundInDatabase (
> 
> +                   EFI_IMAGE_SECURITY_DATABASE,
> 
> +                   mImageDigest,
> 
> +                   &mCertType,
> 
> +                   mImageDigestSize,
> 
> +                   &IsFound
> 
> +                   );
> 
> +      if (!EFI_ERROR (DbStatus) && IsFound) {
> 
>          IsVerified = TRUE;
> 
>        } else {
> 
>          DEBUG ((DEBUG_INFO, "DxeImageVerificationLib: Image is signed but
> signature is not allowed by DB and %s hash of image is not found in DB/DBX.\n",
> mHashTypeStr));
> 
> --
> 2.24.0.windows.2


  parent reply	other threads:[~2020-02-13 10:20 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-06 14:19 [PATCH 0/9] Fix false negative issue in DxeImageVerificationHandler Wang, Jian J
2020-02-06 14:19 ` [PATCH 1/9] SecurityPkg/DxeImageVerificationLib: Fix memory leaks(CVE-2019-14575) Wang, Jian J
2020-02-13  9:34   ` Yao, Jiewen
2020-02-13 16:43   ` [edk2-devel] " Philippe Mathieu-Daudé
2020-02-06 14:19 ` [PATCH 2/9] SecurityPkg/DxeImageVerificationLib: reject CertStack.CertNumber==0 per DBX(CVE-2019-14575) Wang, Jian J
2020-02-13  9:36   ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 3/9] SecurityPkg/DxeImageVerificationLib: fix wrong fetching dbx in IsAllowedByDb(CVE-2019-14575) Wang, Jian J
2020-02-13  9:38   ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 4/9] SecurityPkg/DxeImageVerificationLib: avoid bypass in " Wang, Jian J
2020-02-13  9:39   ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 5/9] SecurityPkg/DxeImageVerificationLib: refactor db/dbx fetching code " Wang, Jian J
2020-02-13  9:44   ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 6/9] SecurityPkg/DxeImageVerificationLib: Differentiate error and search result in IsCertHashFoundInDatabase(CVE-2019-14575) Wang, Jian J
2020-02-13 10:11   ` Yao, Jiewen
2020-02-13 15:07     ` Wang, Jian J
2020-02-14  0:54       ` Yao, Jiewen
2020-02-14  3:31         ` Wang, Jian J
2020-02-14  3:33           ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 7/9] SecurityPkg/DxeImageVerificationLib: tighten default result of IsForbiddenByDbx()(CVE-2019-14575) Wang, Jian J
2020-02-13 10:13   ` Yao, Jiewen
2020-02-06 14:19 ` [PATCH 8/9] SecurityPkg/DxeImageVerificationLib: plug Data leak in IsForbiddenByDbx()(CVE-2019-14575) Wang, Jian J
2020-02-13 10:14   ` Yao, Jiewen
2020-02-13 16:56   ` [edk2-devel] " Philippe Mathieu-Daudé
2020-02-06 14:19 ` [PATCH 9/9] SecurityPkg/DxeImageVerificationLib: Differentiate error and search result in IsSignatureFoundInDatabase(CVE-2019-14575) Wang, Jian J
2020-02-13  9:02   ` [edk2-devel] " Zhang, Chao B
2020-02-13 10:20   ` Yao, Jiewen [this message]
2020-02-13  1:53 ` [edk2-devel] [PATCH 0/9] Fix false negative issue in DxeImageVerificationHandler Liming Gao

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=74D8A39837DF1E4DA445A8C0B3885C503F92CCE5@shsmsx102.ccr.corp.intel.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox