Re: [edk2-devel] [PATCH v1 07/14] NetworkPkg:: SECURITY PATCH CVE-2023-45237

["Ard Biesheuvel" <ardb@kernel.org>]

On Wed, 8 May 2024 at 17:29, Doug Flick via groups.io
<dougflick=microsoft.com@groups.io> wrote:
>
> From: Doug Flick <dougflick@microsoft.com>
>
> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4542
>
> Bug Overview:
> PixieFail Bug #9
> CVE-2023-45237
> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
> CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
>
> Use of a Weak PseudoRandom Number Generator
>
> Change Overview:
>
> Updates all Instances of NET_RANDOM (NetRandomInitSeed ()) to either
>
> >
> > EFI_STATUS
> > EFIAPI
> > PseudoRandomU32 (
> >  OUT UINT32  *Output
> >  );
> >
>
> or (depending on the use case)
>
> >
> > EFI_STATUS
> > EFIAPI
> > PseudoRandom (
> >  OUT  VOID   *Output,
> >  IN   UINTN  OutputLength
> >  );
> >
>
> This is because the use of
>
> Example:
>
> The following code snippet PseudoRandomU32 () function is used:
>
> >
> > UINT32         Random;
> >
> > Status = PseudoRandomU32 (&Random);
> > if (EFI_ERROR (Status)) {
> >   DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n",
> __func__, Status));
> >   return Status;
> > }
> >
>
> This also introduces a new PCD to enable/disable the use of the
> NIST SP-800-90 approved algorithms for PseudoRandom () and
> instead depend on the default implementation. This may be required for
> some platforms where the UEFI Spec defined algorithms are not available.
>
> >
> > PcdEnforceSecureRngAlgorithms
> >
>
> If the platform does not have the NIST SP-800-90 approved algorithms
> then the driver will assert.
>
> Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
>
> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
> ---
>  NetworkPkg/NetworkPkg.dec                  |   7 ++
>  NetworkPkg/Library/DxeNetLib/DxeNetLib.inf |  12 +-
>  NetworkPkg/TcpDxe/TcpDxe.inf               |   3 +
>  NetworkPkg/IScsiDxe/IScsiMisc.h            |   6 +-
>  NetworkPkg/Include/Library/NetLib.h        |  40 ++++--
>  NetworkPkg/Ip6Dxe/Ip6Nd.h                  |   8 +-
>  NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c          |  10 +-
>  NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c          |  11 +-
>  NetworkPkg/DnsDxe/DnsDhcp.c                |  10 +-
>  NetworkPkg/DnsDxe/DnsImpl.c                |  11 +-
>  NetworkPkg/HttpBootDxe/HttpBootDhcp6.c     |  10 +-
>  NetworkPkg/IScsiDxe/IScsiCHAP.c            |  19 ++-
>  NetworkPkg/IScsiDxe/IScsiMisc.c            |  14 +--
>  NetworkPkg/Ip4Dxe/Ip4Driver.c              |  10 +-
>  NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c          |   9 +-
>  NetworkPkg/Ip6Dxe/Ip6Driver.c              |  17 ++-
>  NetworkPkg/Ip6Dxe/Ip6If.c                  |  12 +-
>  NetworkPkg/Ip6Dxe/Ip6Mld.c                 |  12 +-
>  NetworkPkg/Ip6Dxe/Ip6Nd.c                  |  33 ++++-
>  NetworkPkg/Library/DxeNetLib/DxeNetLib.c   | 129 +++++++++++++++++---
>  NetworkPkg/TcpDxe/TcpDriver.c              |  15 ++-
>  NetworkPkg/Udp4Dxe/Udp4Driver.c            |  10 +-
>  NetworkPkg/Udp6Dxe/Udp6Driver.c            |  11 +-
>  NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c       |   9 +-
>  NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c       |  11 +-
>  NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c      |  12 +-
>  NetworkPkg/SecurityFixes.yaml              |  39 ++++++
>  27 files changed, 407 insertions(+), 83 deletions(-)
>
> diff --git a/NetworkPkg/NetworkPkg.dec b/NetworkPkg/NetworkPkg.dec
> index e06f35e7747c..7c4289b77b21 100644
> --- a/NetworkPkg/NetworkPkg.dec
> +++ b/NetworkPkg/NetworkPkg.dec
> @@ -5,6 +5,7 @@
>  #
>  # Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.<BR>
>  # (C) Copyright 2015-2020 Hewlett Packard Enterprise Development LP<BR>
> +# Copyright (c) Microsoft Corporation
>  #
>  # SPDX-License-Identifier: BSD-2-Clause-Patent
>  #
> @@ -130,6 +131,12 @@ [PcdsFixedAtBuild, PcdsPatchableInModule]
>    # @Prompt Indicates whether SnpDxe creates event for ExitBootServices() call.
>    gEfiNetworkPkgTokenSpaceGuid.PcdSnpCreateExitBootServicesEvent|TRUE|BOOLEAN|0x1000000C
>
> +  ## Enforces the use of Secure UEFI spec defined RNG algorithms for all network connections.
> +  # TRUE  - Enforce the use of Secure UEFI spec defined RNG algorithms.
> +  # FALSE - Do not enforce and depend on the default implementation of RNG algorithm from the provider.
> +  # @Prompt Enforce the use of Secure UEFI spec defined RNG algorithms.
> +  gEfiNetworkPkgTokenSpaceGuid.PcdEnforceSecureRngAlgorithms|TRUE|BOOLEAN|0x1000000D
> +

This conflates 'secure' with 'specified by NIST', which I don't think
is entirely accurate.


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118691): https://edk2.groups.io/g/devel/message/118691
Mute This Topic: https://groups.io/mt/105983246/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-