Re: [edk2-devel][edk2-stable202405][PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount

["Michael D Kinney" <michael.d.kinney@intel.com>]

I agree it should catch edk2-stable202405

Mike

> -----Original Message-----
> From: gaoliming <gaoliming@byosoft.com.cn>
> Sent: Thursday, May 9, 2024 12:24 AM
> To: devel@edk2.groups.io; Pakkirisamy, ShanmugavelX
> <shanmugavelx.pakkirisamy@intel.com>
> Cc: Liu, Zhiguang <zhiguang.liu@intel.com>; Bi, Dandan <dandan.bi@intel.com>;
> 'Leif Lindholm' <quic_llindhol@quicinc.com>; 'Andrew Fish' <afish@apple.com>;
> Kinney, Michael D <michael.d.kinney@intel.com>
> Subject: 回复: [edk2-devel][edk2-stable202405][PATCH] MdeModulePkg: Potential
> UINT32 overflow in S3 ResumeCount
> 
> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
> 
> This is a security fix. So, I think it should catch this stable tag 202405
> 
> Thanks
> Liming
> > -----邮件原件-----
> > 发件人: devel@edk2.groups.io <devel@edk2.groups.io> 代表 Pakkirisamy
> > ShanmugavelX
> > 发送时间: 2024年5月6日 17:53
> > 收件人: devel@edk2.groups.io
> > 抄送: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>;
> > Zhiguang Liu <zhiguang.liu@intel.com>; Dandan Bi <dandan.bi@intel.com>;
> > Liming Gao <gaoliming@byosoft.com.cn>
> > 主题: [edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3
> > ResumeCount
> >
> > From: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>
> >
> > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677
> >
> > Attacker able to modify physical memory and ResumeCount.
> > System will crash/DoS when ResumeCount reaches its MAX_UINT32.
> >
> > Cc: Zhiguang Liu <zhiguang.liu@intel.com>
> > Cc: Dandan Bi <dandan.bi@intel.com>
> > Cc: Liming Gao <gaoliming@byosoft.com.cn>
> >
> > Signed-off-by: Pakkirisamy ShanmugavelX
> > <shanmugavelx.pakkirisamy@intel.com>
> > ---
> >
> > MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePe
> > rformancePei.c | 14 +++++++++-----
> >  1 file changed, 9 insertions(+), 5 deletions(-)
> >
> > diff --git
> > a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > index 2f2b2a80b2..1035ed8640 100644
> > ---
> > a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > +++
> > b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware
> > PerformancePei.c
> > @@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei (
> >    //
> >    S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume,
> > AcpiS3ResumeRecord->ResumeCount);
> >    AcpiS3ResumeRecord->ResumeCount++;
> > -  AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> > AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> > -
> > -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount
> > = %d\n", AcpiS3ResumeRecord->ResumeCount));
> > -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume
> > = %ld\n", AcpiS3ResumeRecord->FullResume));
> > -  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume
> > = %ld\n", AcpiS3ResumeRecord->AverageResume));
> > +  if (AcpiS3ResumeRecord->ResumeCount > 0) {
> > +    AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal +
> > AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
> > +    DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance -
> > AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
> > +  }
> > +  else {
> > +    DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the
> > MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
> > +  }
> > +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount   =
> > 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
> > +  DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume    =
> > 0x%x\n", AcpiS3ResumeRecord->FullResume));
> >
> >    //
> >    // Update S3 Suspend Performance Record.
> > --
> > 2.45.0.windows.1
> >
> >
> >
> > 
> >
> 
> 



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#118891): https://edk2.groups.io/g/devel/message/118891
Mute This Topic: https://groups.io/mt/106097838/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-