From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id EA91F740032 for ; Wed, 8 May 2024 16:20:40 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=lN2L7PG7LpBipMJZLSFvq2lKuaSi6E8AoE8mR+TZ2Fc=; c=relaxed/simple; d=groups.io; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:To:Cc:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Type; s=20240206; t=1715185239; v=1; b=zh7moOndn3ti50+58zTueaYPi7eId74K7SpGIUm/2TGqITlFGnaXdb6y1hW0PN2d6hSa9OJH RAEqyLNiwUnd3z+DBu158OsDtsJQi/rbZDSh2IDZYQZdL3fOXzXN3dYJew0PakYQlMbKPt2iDA9 fnBqG2K9bpbQ+4yK8ZIVuurpfDkU9XhH/eKPoibgZ9FPq0KGcTJ3HoxAo6oyI9SjB1d9UCrI/41 8KsN8hrWwkll5ViNKoqwaLjsXEeh5ZB9V/TvnVtm1HUNPLp2CoaR7qPiNzYczViRODTKkJA2GSJ 8B5v8E6ghqPujSfWATeN/dZjfEW3JFSGA0u2WLrb3tyRw== X-Received: by 127.0.0.2 with SMTP id qkyoYY7687511xqXmDPtu4IR; Wed, 08 May 2024 09:20:39 -0700 X-Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by mx.groups.io with SMTP id smtpd.web10.1217.1715185238096428669 for ; Wed, 08 May 2024 09:20:38 -0700 X-Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sin.source.kernel.org (Postfix) with ESMTP id 75DF1CE19C2 for ; Wed, 8 May 2024 16:20:35 +0000 (UTC) X-Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4105C32782 for ; Wed, 8 May 2024 16:20:34 +0000 (UTC) X-Received: by mail-lj1-f177.google.com with SMTP id 38308e7fff4ca-2e45c0a8360so9176161fa.3 for ; Wed, 08 May 2024 09:20:34 -0700 (PDT) X-Gm-Message-State: V4rvW4TDDEcF3XTU8RaVcAj1x7686176AA= X-Google-Smtp-Source: AGHT+IFcDZmzbV4orqfLfrCVo/mbdhR3tGSa9b14vPPnMat/VlON/XEgAfwfLIEQSa1tjPPoSJHdV+nTZn4GdApTBMw= X-Received: by 2002:a2e:8317:0:b0:2e1:18d:5b4f with SMTP id 38308e7fff4ca-2e4476ad07fmr18984731fa.42.1715185232959; Wed, 08 May 2024 09:20:32 -0700 (PDT) MIME-Version: 1.0 References: <20240508152925.741226-1-doug.edk2@gmail.com> <20240508152925.741226-8-doug.edk2@gmail.com> In-Reply-To: <20240508152925.741226-8-doug.edk2@gmail.com> From: "Ard Biesheuvel" Date: Wed, 8 May 2024 18:20:21 +0200 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [edk2-devel] [PATCH v1 07/14] NetworkPkg:: SECURITY PATCH CVE-2023-45237 To: devel@edk2.groups.io, dougflick@microsoft.com Cc: Saloni Kasbekar , Zachary Clark-williams Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Wed, 08 May 2024 09:20:38 -0700 Resent-From: ardb@kernel.org Reply-To: devel@edk2.groups.io,ardb@kernel.org List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Content-Type: text/plain; charset="UTF-8" X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=zh7moOnd; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=kernel.org (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io On Wed, 8 May 2024 at 17:29, Doug Flick via groups.io wrote: > > From: Doug Flick > > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4542 > > Bug Overview: > PixieFail Bug #9 > CVE-2023-45237 > CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N > CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) > > Use of a Weak PseudoRandom Number Generator > > Change Overview: > > Updates all Instances of NET_RANDOM (NetRandomInitSeed ()) to either > > > > > EFI_STATUS > > EFIAPI > > PseudoRandomU32 ( > > OUT UINT32 *Output > > ); > > > > or (depending on the use case) > > > > > EFI_STATUS > > EFIAPI > > PseudoRandom ( > > OUT VOID *Output, > > IN UINTN OutputLength > > ); > > > > This is because the use of > > Example: > > The following code snippet PseudoRandomU32 () function is used: > > > > > UINT32 Random; > > > > Status = PseudoRandomU32 (&Random); > > if (EFI_ERROR (Status)) { > > DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", > __func__, Status)); > > return Status; > > } > > > > This also introduces a new PCD to enable/disable the use of the > NIST SP-800-90 approved algorithms for PseudoRandom () and > instead depend on the default implementation. This may be required for > some platforms where the UEFI Spec defined algorithms are not available. > > > > > PcdEnforceSecureRngAlgorithms > > > > If the platform does not have the NIST SP-800-90 approved algorithms > then the driver will assert. > > Cc: Saloni Kasbekar > Cc: Zachary Clark-williams > > Signed-off-by: Doug Flick [MSFT] > --- > NetworkPkg/NetworkPkg.dec | 7 ++ > NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 12 +- > NetworkPkg/TcpDxe/TcpDxe.inf | 3 + > NetworkPkg/IScsiDxe/IScsiMisc.h | 6 +- > NetworkPkg/Include/Library/NetLib.h | 40 ++++-- > NetworkPkg/Ip6Dxe/Ip6Nd.h | 8 +- > NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c | 10 +- > NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c | 11 +- > NetworkPkg/DnsDxe/DnsDhcp.c | 10 +- > NetworkPkg/DnsDxe/DnsImpl.c | 11 +- > NetworkPkg/HttpBootDxe/HttpBootDhcp6.c | 10 +- > NetworkPkg/IScsiDxe/IScsiCHAP.c | 19 ++- > NetworkPkg/IScsiDxe/IScsiMisc.c | 14 +-- > NetworkPkg/Ip4Dxe/Ip4Driver.c | 10 +- > NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c | 9 +- > NetworkPkg/Ip6Dxe/Ip6Driver.c | 17 ++- > NetworkPkg/Ip6Dxe/Ip6If.c | 12 +- > NetworkPkg/Ip6Dxe/Ip6Mld.c | 12 +- > NetworkPkg/Ip6Dxe/Ip6Nd.c | 33 ++++- > NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 129 +++++++++++++++++--- > NetworkPkg/TcpDxe/TcpDriver.c | 15 ++- > NetworkPkg/Udp4Dxe/Udp4Driver.c | 10 +- > NetworkPkg/Udp6Dxe/Udp6Driver.c | 11 +- > NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c | 9 +- > NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c | 11 +- > NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c | 12 +- > NetworkPkg/SecurityFixes.yaml | 39 ++++++ > 27 files changed, 407 insertions(+), 83 deletions(-) > > diff --git a/NetworkPkg/NetworkPkg.dec b/NetworkPkg/NetworkPkg.dec > index e06f35e7747c..7c4289b77b21 100644 > --- a/NetworkPkg/NetworkPkg.dec > +++ b/NetworkPkg/NetworkPkg.dec > @@ -5,6 +5,7 @@ > # > # Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.
> # (C) Copyright 2015-2020 Hewlett Packard Enterprise Development LP
> +# Copyright (c) Microsoft Corporation > # > # SPDX-License-Identifier: BSD-2-Clause-Patent > # > @@ -130,6 +131,12 @@ [PcdsFixedAtBuild, PcdsPatchableInModule] > # @Prompt Indicates whether SnpDxe creates event for ExitBootServices() call. > gEfiNetworkPkgTokenSpaceGuid.PcdSnpCreateExitBootServicesEvent|TRUE|BOOLEAN|0x1000000C > > + ## Enforces the use of Secure UEFI spec defined RNG algorithms for all network connections. > + # TRUE - Enforce the use of Secure UEFI spec defined RNG algorithms. > + # FALSE - Do not enforce and depend on the default implementation of RNG algorithm from the provider. > + # @Prompt Enforce the use of Secure UEFI spec defined RNG algorithms. > + gEfiNetworkPkgTokenSpaceGuid.PcdEnforceSecureRngAlgorithms|TRUE|BOOLEAN|0x1000000D > + This conflates 'secure' with 'specified by NIST', which I don't think is entirely accurate. -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118691): https://edk2.groups.io/g/devel/message/118691 Mute This Topic: https://groups.io/mt/105983246/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-