From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=134.134.136.65; helo=mga03.intel.com; envelope-from=hao.a.wu@intel.com; receiver=edk2-devel@lists.01.org Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 5BE082117FD78 for ; Thu, 15 Nov 2018 19:45:08 -0800 (PST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Nov 2018 19:45:07 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,238,1539673200"; d="scan'208";a="86359735" Received: from fmsmsx105.amr.corp.intel.com ([10.18.124.203]) by fmsmga007.fm.intel.com with ESMTP; 15 Nov 2018 19:45:07 -0800 Received: from fmsmsx101.amr.corp.intel.com (10.18.124.199) by FMSMSX105.amr.corp.intel.com (10.18.124.203) with Microsoft SMTP Server (TLS) id 14.3.408.0; Thu, 15 Nov 2018 19:45:07 -0800 Received: from shsmsx102.ccr.corp.intel.com (10.239.4.154) by fmsmsx101.amr.corp.intel.com (10.18.124.199) with Microsoft SMTP Server (TLS) id 14.3.408.0; Thu, 15 Nov 2018 19:45:06 -0800 Received: from shsmsx104.ccr.corp.intel.com ([169.254.5.117]) by shsmsx102.ccr.corp.intel.com ([169.254.2.84]) with mapi id 14.03.0415.000; Fri, 16 Nov 2018 11:45:03 +0800 From: "Wu, Hao A" To: "Zeng, Star" , "edk2-devel@lists.01.org" CC: Laszlo Ersek , "Yao, Jiewen" Thread-Topic: [edk2] [PATCH v1 1/2] MdeModulePkg/SmmCorePerfLib: [CVE-2017-5753] Fix bounds check bypass Thread-Index: AQHUfUz+wqfziMkeRUSQGSD5zo40S6VRNA8AgACOYXA= Date: Fri, 16 Nov 2018 03:45:03 +0000 Message-ID: References: <20181116013737.32272-1-hao.a.wu@intel.com> <20181116013737.32272-2-hao.a.wu@intel.com> <85786150-dbb8-9abe-ce5c-96a9d4f2167a@intel.com> In-Reply-To: <85786150-dbb8-9abe-ce5c-96a9d4f2167a@intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Subject: Re: [PATCH v1 1/2] MdeModulePkg/SmmCorePerfLib: [CVE-2017-5753] Fix bounds check bypass X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Nov 2018 03:45:09 -0000 Content-Language: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBaZW5nLCBTdGFyDQo+IFNlbnQ6 IEZyaWRheSwgTm92ZW1iZXIgMTYsIDIwMTggMTE6MTQgQU0NCj4gVG86IFd1LCBIYW8gQTsgZWRr Mi1kZXZlbEBsaXN0cy4wMS5vcmcNCj4gQ2M6IExhc3psbyBFcnNlazsgWWFvLCBKaWV3ZW47IFpl bmcsIFN0YXINCj4gU3ViamVjdDogUmU6IFtlZGsyXSBbUEFUQ0ggdjEgMS8yXSBNZGVNb2R1bGVQ a2cvU21tQ29yZVBlcmZMaWI6IFtDVkUtDQo+IDIwMTctNTc1M10gRml4IGJvdW5kcyBjaGVjayBi eXBhc3MNCj4gDQo+IE9uIDIwMTgvMTEvMTYgOTozNywgSGFvIFd1IHdyb3RlOg0KPiA+IFJFRjpo dHRwczovL2J1Z3ppbGxhLnRpYW5vY29yZS5vcmcvc2hvd19idWcuY2dpP2lkPTExOTQNCj4gPg0K PiA+IFNwZWN1bGF0aXZlIGV4ZWN1dGlvbiBpcyB1c2VkIGJ5IHByb2Nlc3NvciB0byBhdm9pZCBo YXZpbmcgdG8gd2FpdCBmb3INCj4gPiBkYXRhIHRvIGFycml2ZSBmcm9tIG1lbW9yeSwgb3IgZm9y IHByZXZpb3VzIG9wZXJhdGlvbnMgdG8gZmluaXNoLCB0aGUNCj4gPiBwcm9jZXNzb3IgbWF5IHNw ZWN1bGF0ZSBhcyB0byB3aGF0IHdpbGwgYmUgZXhlY3V0ZWQuDQo+ID4NCj4gPiBJZiB0aGUgc3Bl Y3VsYXRpb24gaXMgaW5jb3JyZWN0LCB0aGUgc3BlY3VsYXRpdmVseSBleGVjdXRlZCBpbnN0cnVj dGlvbnMNCj4gPiBtaWdodCBsZWF2ZSBoaW50cyBzdWNoIGFzIHdoaWNoIG1lbW9yeSBsb2NhdGlv bnMgaGF2ZSBiZWVuIGJyb3VnaHQgaW50bw0KPiA+IGNhY2hlLiBNYWxpY2lvdXMgYWN0b3JzIGNh biB1c2UgdGhlIGJvdW5kcyBjaGVjayBieXBhc3MgbWV0aG9kIChjb2RlDQo+ID4gZ2FkZ2V0cyB3 aXRoIGNvbnRyb2xsZWQgZXh0ZXJuYWwgaW5wdXRzKSB0byBpbmZlciBkYXRhIHZhbHVlcyB0aGF0 IGhhdmUNCj4gPiBiZWVuIHVzZWQgaW4gc3BlY3VsYXRpdmUgb3BlcmF0aW9ucyB0byByZXZlYWwg c2VjcmV0cyB3aGljaCBzaG91bGQgbm90DQo+ID4gb3RoZXJ3aXNlIGJlIGFjY2Vzc2VkLg0KPiA+ DQo+ID4gVGhpcyBjb21taXQgd2lsbCBmb2N1cyBvbiB0aGUgU01JIGhhbmRsZXIocykgcmVnaXN0 ZXJlZCB3aXRoaW4gdGhlDQo+ID4gVEJELg0KPiANCj4gV2hhdCBkb2VzIHRoZSAnVEJEJyBtZWFu IGhlcmU/DQoNClNvcnJ5LiBQYXRjaCB3YXMgZ2VuZXJhdGVkIG9uIHRoZSB3cm9uZyBjb21taXQs IEkgd2lsbCBzZW5kIGEgVjIgb2YgdGhlIHNlcmllcw0KdG8gYWRkcmVzcyB0aGlzLg0KDQpCZXN0 IFJlZ2FyZHMsDQpIYW8gV3UNCg0KPiANCj4gVGhhbmtzLA0KPiBTdGFyDQo+IA0KPiA+DQo+ID4g SGVuY2UsIHRoaXMgY29tbWl0IGFkZHMgYSBBc21MZmVuY2UoKSBhZnRlciB0aGUgYm91bmRhcnkv cmFuZ2UgY2hlY2tzIG9mDQo+ID4gJ0NvbW1CdWZmZXInIHRvIHByZXZlbnQgdGhlIHNwZWN1bGF0 aXZlIGV4ZWN1dGlvbi4NCj4gPg0KPiA+IEEgbW9yZSBkZXRhaWxlZCBleHBsYW5hdGlvbiBvZiB0 aGUgcHVycG9zZSBvZiBjb21taXQgaXMgdW5kZXIgdGhlDQo+ID4gJ0JvdW5kcyBjaGVjayBieXBh c3MgbWl0aWdhdGlvbicgc2VjdGlvbiBvZiB0aGUgYmVsb3cgbGluazoNCj4gPiBodHRwczovL3Nv ZnR3YXJlLmludGVsLmNvbS9zZWN1cml0eS1zb2Z0d2FyZS1ndWlkYW5jZS9pbnNpZ2h0cy9ob3N0 LQ0KPiBmaXJtd2FyZS1zcGVjdWxhdGl2ZS1leGVjdXRpb24tc2lkZS1jaGFubmVsLW1pdGlnYXRp b24NCj4gPg0KPiA+IEFuZCB0aGUgZG9jdW1lbnQgYXQ6DQo+ID4gaHR0cHM6Ly9zb2Z0d2FyZS5p bnRlbC5jb20vc2VjdXJpdHktc29mdHdhcmUtZ3VpZGFuY2UvYXBpLQ0KPiBhcHAvc2l0ZXMvZGVm YXVsdC9maWxlcy8zMzc4NzktYW5hbHl6aW5nLXBvdGVudGlhbC1ib3VuZHMtQ2hlY2stYnlwYXNz LQ0KPiB2dWxuZXJhYmlsaXRpZXMucGRmDQo+ID4NCj4gPiBDYzogU3RhciBaZW5nIDxzdGFyLnpl bmdAaW50ZWwuY29tPg0KPiA+IENjOiBKaWV3ZW4gWWFvIDxqaWV3ZW4ueWFvQGludGVsLmNvbT4N Cj4gPiBDYzogTGFzemxvIEVyc2VrIDxsZXJzZWtAcmVkaGF0LmNvbT4NCj4gPiBDb250cmlidXRl ZC11bmRlcjogVGlhbm9Db3JlIENvbnRyaWJ1dGlvbiBBZ3JlZW1lbnQgMS4xDQo+ID4gU2lnbmVk LW9mZi1ieTogSGFvIFd1IDxoYW8uYS53dUBpbnRlbC5jb20+DQo+ID4gLS0tDQo+ID4NCj4gTWRl TW9kdWxlUGtnL0xpYnJhcnkvU21tQ29yZVBlcmZvcm1hbmNlTGliL1NtbUNvcmVQZXJmb3JtYW5j ZUxpYi5jDQo+IHwgMTYgKysrKysrKysrKysrKysrLQ0KPiA+ICAgMSBmaWxlIGNoYW5nZWQsIDE1 IGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkNCj4gPg0KPiA+IGRpZmYgLS1naXQNCj4gYS9N ZGVNb2R1bGVQa2cvTGlicmFyeS9TbW1Db3JlUGVyZm9ybWFuY2VMaWIvU21tQ29yZVBlcmZvcm1h bmNlTGliDQo+IC5jDQo+IGIvTWRlTW9kdWxlUGtnL0xpYnJhcnkvU21tQ29yZVBlcmZvcm1hbmNl TGliL1NtbUNvcmVQZXJmb3JtYW5jZUxpYg0KPiAuYw0KPiA+IGluZGV4IGNkMWYxYTVkNWYuLjYz YzFlZWEzYTIgMTAwNjQ0DQo+ID4gLS0tDQo+IGEvTWRlTW9kdWxlUGtnL0xpYnJhcnkvU21tQ29y ZVBlcmZvcm1hbmNlTGliL1NtbUNvcmVQZXJmb3JtYW5jZUxpYg0KPiAuYw0KPiA+ICsrKw0KPiBi L01kZU1vZHVsZVBrZy9MaWJyYXJ5L1NtbUNvcmVQZXJmb3JtYW5jZUxpYi9TbW1Db3JlUGVyZm9y bWFuY2VMaWINCj4gLmMNCj4gPiBAQCAtMTYsNyArMTYsNyBAQA0KPiA+DQo+ID4gICAgU21tUGVy Zm9ybWFuY2VIYW5kbGVyRXgoKSwgU21tUGVyZm9ybWFuY2VIYW5kbGVyKCkgd2lsbCByZWNlaXZl DQo+IHVudHJ1c3RlZCBpbnB1dCBhbmQgZG8gYmFzaWMgdmFsaWRhdGlvbi4NCj4gPg0KPiA+IC1D b3B5cmlnaHQgKGMpIDIwMTEgLSAyMDE3LCBJbnRlbCBDb3Jwb3JhdGlvbi4gQWxsIHJpZ2h0cyBy ZXNlcnZlZC48QlI+DQo+ID4gK0NvcHlyaWdodCAoYykgMjAxMSAtIDIwMTgsIEludGVsIENvcnBv cmF0aW9uLiBBbGwgcmlnaHRzIHJlc2VydmVkLjxCUj4NCj4gPiAgIFRoaXMgcHJvZ3JhbSBhbmQg dGhlIGFjY29tcGFueWluZyBtYXRlcmlhbHMNCj4gPiAgIGFyZSBsaWNlbnNlZCBhbmQgbWFkZSBh dmFpbGFibGUgdW5kZXIgdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHRoZSBCU0QNCj4gTGlj ZW5zZQ0KPiA+ICAgd2hpY2ggYWNjb21wYW5pZXMgdGhpcyBkaXN0cmlidXRpb24uICBUaGUgZnVs bCB0ZXh0IG9mIHRoZSBsaWNlbnNlIG1heSBiZQ0KPiBmb3VuZCBhdA0KPiA+IEBAIC01MzgsNiAr NTM4LDEzIEBAIFNtbVBlcmZvcm1hbmNlSGFuZGxlckV4ICgNCj4gPiAgICAgICAgICAgIGJyZWFr Ow0KPiA+ICAgICAgICAgIH0NCj4gPg0KPiA+ICsgICAgICAgLy8NCj4gPiArICAgICAgIC8vIFRo ZSBBc21MZmVuY2UoKSBjYWxsIGhlcmUgaXMgdG8gZW5zdXJlIHRoZSBwcmV2aW91cyByYW5nZS9j b250ZW50DQo+ID4gKyAgICAgICAvLyBjaGVja3MgZm9yIHRoZSBDb21tQnVmZmVyIGhhdmUgYmVl biBjb21wbGV0ZWQgYmVmb3JlIGNhbGxpbmcNCj4gPiArICAgICAgIC8vIENvcHlNZW0oKS4NCj4g PiArICAgICAgIC8vDQo+ID4gKyAgICAgICBBc21MZmVuY2UgKCk7DQo+ID4gKw0KPiA+ICAgICAg ICAgIEdhdWdlRW50cnlFeEFycmF5ID0gKEdBVUdFX0RBVEFfRU5UUllfRVggKikgKG1HYXVnZURh dGEgKyAxKTsNCj4gPg0KPiA+ICAgICAgICAgIGZvciAoSW5kZXggPSAwOyBJbmRleCA8IE51bWJl ck9mRW50cmllczsgSW5kZXgrKykgew0KPiA+IEBAIC02NTAsNiArNjU3LDEzIEBAIFNtbVBlcmZv cm1hbmNlSGFuZGxlciAoDQo+ID4gICAgICAgICAgICBicmVhazsNCj4gPiAgICAgICAgICB9DQo+ ID4NCj4gPiArICAgICAgIC8vDQo+ID4gKyAgICAgICAvLyBUaGUgQXNtTGZlbmNlKCkgY2FsbCBo ZXJlIGlzIHRvIGVuc3VyZSB0aGUgcHJldmlvdXMgcmFuZ2UvY29udGVudA0KPiA+ICsgICAgICAg Ly8gY2hlY2tzIGZvciB0aGUgQ29tbUJ1ZmZlciBoYXZlIGJlZW4gY29tcGxldGVkIGJlZm9yZSBj YWxsaW5nDQo+ID4gKyAgICAgICAvLyBDb3B5TWVtKCkuDQo+ID4gKyAgICAgICAvLw0KPiA+ICsg ICAgICAgQXNtTGZlbmNlICgpOw0KPiA+ICsNCj4gPiAgICAgICAgICBHYXVnZUVudHJ5RXhBcnJh eSA9IChHQVVHRV9EQVRBX0VOVFJZX0VYICopIChtR2F1Z2VEYXRhICsgMSk7DQo+ID4NCj4gPiAg ICAgICAgICBmb3IgKEluZGV4ID0gMDsgSW5kZXggPCBOdW1iZXJPZkVudHJpZXM7IEluZGV4Kysp IHsNCj4gPg0KDQo=