From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web11.3887.1679365740886456855 for ; Mon, 20 Mar 2023 19:29:01 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=IS1O3Brr; spf=pass (domain: intel.com, ip: 192.55.52.88, mailfrom: jiewen.yao@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1679365740; x=1710901740; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=jkxOMZwoy36kq6gl7cBuogR/SdPjQguNYXmgX7paUco=; b=IS1O3BrrArc/ejBFXq5mjBV9TbHWXzhFlpSgQBcyACW3/rjf7OV8bszg Csv7BwkanncSSDhshAev5jZU774OR6/ow2tRWSJsCjzS0yWinPQKrfCWS TVdS8PCFMZxODOW7D601f2H/NtBNjFJ7rxb+qeye9TCcip6WTb1d2uLd3 NWStKVRP3+4cycBKIE4uOYYxnRU+8AK4b2SOQQrrs6p8Bcmmf7U592nSo ZRIa/nh3zgJ23BrztAXym4VGuavtcMw1mnf+AzPX938yvSlDp8Y6wzdy6 UvIE6Qcb1zJD0swFYOYpQSVOa613SVS/a/HpFdMUd8Hunlao1Lj2NcsYU g==; X-IronPort-AV: E=McAfee;i="6600,9927,10655"; a="366556333" X-IronPort-AV: E=Sophos;i="5.98,277,1673942400"; d="scan'208";a="366556333" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Mar 2023 19:29:00 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10655"; a="681349281" X-IronPort-AV: E=Sophos;i="5.98,277,1673942400"; d="scan'208";a="681349281" Received: from fmsmsx601.amr.corp.intel.com ([10.18.126.81]) by orsmga002.jf.intel.com with ESMTP; 20 Mar 2023 19:28:59 -0700 Received: from fmsmsx603.amr.corp.intel.com (10.18.126.83) by fmsmsx601.amr.corp.intel.com (10.18.126.81) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.21; Mon, 20 Mar 2023 19:28:59 -0700 Received: from FMSEDG603.ED.cps.intel.com (10.1.192.133) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.21 via Frontend Transport; Mon, 20 Mar 2023 19:28:59 -0700 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (104.47.55.103) by edgegateway.intel.com (192.55.55.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.21; Mon, 20 Mar 2023 19:28:58 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KjCBGW6j0MRNJ3spBiq6HgRA8qcmMP4a/2koqe3IbGzBIYt84tPsqEYtnulale83cG4mYL8Xuk5F281nenSmy0/PQeazni9clqsdt3UrEKf1cU+ViXZzIpCqDErJh0qq0obUxffUI4H+AyJfjgJAtxT8qjL63zU3EaW9JNqRkaeq0x/m4oqthOo1baCkxkh5A2ktePZ9iyAhCpb2HctY12pHyawZ9xut1BmEVog9OtAqgRt6U7wbccw28gdLkurWM7KLrvZZ4p+e9WN19MsQoy+pF+woQogZx8t2Is7OSDkYxGJffBX/Hx5q+iekTWcSL14DKv/XmqBuT8X3OtCAPQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ebjmrh6AVVgF30udehKYCZILwNuKXpT3LefleWHLPsA=; b=QZLiMa9ajG8jtSTr16NJp64Wmf4s952GzpS5yIJA4p3SOzHRlxxcsFyw6vOSiML1pRLYSHtnIBV9W5KD5NbG5McrZl08oLhGkq2FowJ4dozGCYHAclafoMW8ufpdU/uvXDUNXaXhmVgDhXWs2iNBNPzs7gQCP+KXppGGlP0NI4HodbgmqOWhAL7NsmwZZF7QvnAVPDx0fmVM4fHGTStloEH3q8/ok0fWUzFsrEy8Hh63iLzqsgvCGqRtnQonv3/nNLB+JX1IoMghuGQMfAjvItdzv3ncbywmDd9IakoyHb07UI43s4piobY4NEKFoL1cfP9el2jbM0KDkUxP6hiu/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none Received: from MW4PR11MB5872.namprd11.prod.outlook.com (2603:10b6:303:169::14) by BL3PR11MB5700.namprd11.prod.outlook.com (2603:10b6:208:33f::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6178.37; Tue, 21 Mar 2023 02:28:56 +0000 Received: from MW4PR11MB5872.namprd11.prod.outlook.com ([fe80::c0c0:4b46:1dd4:80d6]) by MW4PR11MB5872.namprd11.prod.outlook.com ([fe80::c0c0:4b46:1dd4:80d6%5]) with mapi id 15.20.6178.037; Tue, 21 Mar 2023 02:28:56 +0000 From: "Yao, Jiewen" To: "kraxel@redhat.com" , "devel@edk2.groups.io" CC: Pawel Polawski , "Wang, Jian J" , Oliver Steffen , "Xu, Min M" , =?iso-8859-1?Q?Marvin_H=E4user?= , "jmaloy@redhat.com" Subject: Re: [edk2-devel] [PATCH v2 1/1] SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2 Thread-Topic: [edk2-devel] [PATCH v2 1/1] SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2 Thread-Index: AQHZTbv5ATxtbkmMjU+2TqglVnCmYq8DipcAgAA3TICAABv9gIAAwElw Date: Tue, 21 Mar 2023 02:28:56 +0000 Message-ID: References: <20230303103553.804781-1-kraxel@redhat.com> <20230320100208.xhoz7smo5fkhal26@sirius.home.kraxel.org> <20230320150013.ykcaxygkburz4m2s@sirius.home.kraxel.org> In-Reply-To: <20230320150013.ykcaxygkburz4m2s@sirius.home.kraxel.org> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: MW4PR11MB5872:EE_|BL3PR11MB5700:EE_ x-ms-office365-filtering-correlation-id: 8cc4ae37-74fb-4e6c-dd20-08db29b4058a x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: I/bjZ1PetxLJYy/eVIKaIlZ94n01l1EHns8e3v0ggoPrfZVKsTdZWskmw/HQKbPu4Mt177hv2DlUNxCuk90rPmYp2UVK1hpf4seKkymMkJdxMZxa/7dLir1Axdq9+j19s1Gb3qg+M8dz+980YJBqUDJ0R/CYi53+ZzYyYFny+jJ362saTv8MtCheis8KwmKVHJFRTePWVAJKCBAj4AmanAx9iw0edArPkYHXF4fxwDewQQ3+kCfh9AEDRIA6Sow+bYFzvn9hqwhgFXOReCl8vwyMHHEwXmrBdcU251+CmyEUCIVChjMcVTrSksf28UKTTYa1A+0/4jwVfwK7zneHwVeVmTzC6mV+ietihfOwZELZKapGvjIuo8EMUuDp0TKVdfvJ7/3yPqYfCWaYbahksWdLhDT44LacUk6mCsFt7jCbtnVQl17SudBfzSBBtQLvGNQgEA1syfKi7pv/rLl/7z46qM0GOk1nyFqubJWmxLZauwCK0ANbQIw4pY+1yGsxkEy60ho0eTnWJHt5ELG68dzK3oDoyAGSnDkXLEHYr3eD4VqpHjfYu/XDvUAUs8q1STryfxTVvdrAR9CxNCIVuJpqwlm6M5upIy/qrtBVK6E7KqO5oS/PufSNmrgIVZ39mcRZpWSuRsEKqzzJAQ/5YfAoY+0ahrgqblXlKxl1y7BfiGQbLcZsiBshOZ80ImsP2J1fgAGQaNSUnHgMxZB+Qs136lWQ5CWVVolB7VMjiiA= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MW4PR11MB5872.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230025)(366004)(396003)(39860400002)(346002)(136003)(376002)(451199018)(8936002)(52536014)(5660300002)(41300700001)(4326008)(55016003)(33656002)(86362001)(38070700005)(38100700002)(82960400001)(15650500001)(122000001)(2906002)(54906003)(83380400001)(6506007)(53546011)(478600001)(9686003)(7696005)(186003)(966005)(26005)(8676002)(71200400001)(66476007)(66446008)(66899018)(66556008)(19627235002)(76116006)(64756008)(66946007)(110136005)(316002);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?S/bXp4fcp3seOHMBlo2+trh+KkYdQdiyOdk6oMVC/o/h7cWhBihTgdvVlw?= =?iso-8859-1?Q?4UtJwwNcZeAG72irdggrzzRASsvCiQD1jw4g2vSgdeqr0zIMSOK9z6THm+?= =?iso-8859-1?Q?sXaCHAIC9Kl9ccAgUTC6S5YOdk6hA+z69iqEHusehRctHs5FOhOCVEcE6v?= =?iso-8859-1?Q?p43M9l67s166oo2nn5RMNbA8zec899fQK8Y0gq7o9ORj0MsjBoL6WxEDxm?= =?iso-8859-1?Q?Z2zgSJVaei9T95FTtfxcAn4m61XuYKjwRq7eY1LtIPmhvQUQLD1QAkMbOy?= =?iso-8859-1?Q?M8Yd6beLQ8E9FRdWamy3x6uNcXm2YTHAatVVMQKwxQdzYKLjReRwaAQbSP?= =?iso-8859-1?Q?Walh/qAtXWtOOp6I1UaQQgcDoXTEkHuHHLVAg3WlB5hMV+vovllaTRTDgu?= =?iso-8859-1?Q?+vwhfL9MymZSBeOAIPM0BACwkdg70LzQSXb4NpXZUc3qgpCz90gux0Fz9q?= =?iso-8859-1?Q?DwLiGM7dQhAzTY70EdsAApJAKc0ISbdvyAIeyUBHXbMRwjcl5IQOO0X5xJ?= =?iso-8859-1?Q?4nvAS+N/96CFxH+MT8tG3zSCNvaRao3lUO9c/ykAKR7v1ciAhY+bJaBdZm?= =?iso-8859-1?Q?AwsoUbk6+rKf9qcmQSGHcdNHVpws5kIm3d+bghUDOBJpF7TCVJxhrmpwXu?= =?iso-8859-1?Q?9z0Eq3xKZYEbzNE02KcKQc7Hjk5WPbMidRzEjZdXOk1vQm/dSsuybG59Ex?= =?iso-8859-1?Q?mCkuNGs3SqDOf6BJg1xUjGsulsyGph/cqMvj4Vj4zJTZCKaAhB8G6jzUCy?= =?iso-8859-1?Q?qlXVkghVCXk7b9y2w2xyI/vCHo9RjKoKTLTEQYQMGXaH5/ZjolKUXYjY1N?= =?iso-8859-1?Q?+bUTCxGaE5SNRWTgsz4kt9ZrIRHrAxKZFoP2wfIepaeiU3Lqt+6whl9jh8?= =?iso-8859-1?Q?Kwo4n1wpHcE3tchlW9if7/u/D28ThdzrFKT3/u17s7fVvBFUaYrf2c6756?= =?iso-8859-1?Q?Ir77R6x1crr258A7JUdeXss+M1V9EdUbRrIwEDqTwKny/sa642hoMt1sUn?= =?iso-8859-1?Q?QCTnR3scCP8HaP0H0wtxd2iAjw2qpEYZc/bAI0LqedpSV63lR6x990mWsj?= =?iso-8859-1?Q?atEWG4TEEuy7ASmGsBSg8no09NF3qJ4xdArKMtOZpiE7Mg2NL+NIfqJwGd?= =?iso-8859-1?Q?McrUMn6xkKmyMK0UCKG3j2j0PcogEdpTk3Vp8vfSeHxxqkGE2r6rAnd6h1?= =?iso-8859-1?Q?QCzWQTsvVmkDulsTS6ku9Nw544r6ndmntArbvQKJ5F+zMZR/8GK3lxllT7?= =?iso-8859-1?Q?50iWvG8ZsvbAQWWX2teGCML1jqWGDnc2U5L2wzkk9EiPk+JRWEDBWNYIyg?= =?iso-8859-1?Q?Ygic1pxZAd7b8CklicV88pP+ZnMYfbs4m8xFrWAj8vhFknP54sqPcNepgO?= =?iso-8859-1?Q?UQPRziU8KgGRZEVNHUaV9vFvxhi/FDoMOwGiaHSS1WMa1BU3xngQCI4KsH?= =?iso-8859-1?Q?o0mSKUuPBa0TgWzj8SlQD1U0nKY4Rklmo2BButxBOQmZH+94yQEIPKDZ8I?= =?iso-8859-1?Q?H0PocX+xzKYrMsgSR/BdEpIg0qk2J3tbfmUXiWB0rZa7xeF3/1discHRPV?= =?iso-8859-1?Q?Zh2AzmC/LLMwRINFYvG2IG7qY9S8KE8GpF1U9rhmDyd+JlNBsgloEYQETm?= =?iso-8859-1?Q?YAyqH0zSJbe8pz4qUSYiS1iZNsqW0kVsNK?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MW4PR11MB5872.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8cc4ae37-74fb-4e6c-dd20-08db29b4058a X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Mar 2023 02:28:56.6271 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: AJC4HMXCIzrhAajs22FKQEN6s40+gAhaGeSCMqs2rtiBz05vw7VoNYHrgduDlQYnesYrNWfRXkGjKGSxEhtmJA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR11MB5700 Return-Path: jiewen.yao@intel.com X-OriginatorOrg: intel.com Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sounds good. Thanks. Reviewed-by: Jiewen Yao > -----Original Message----- > From: kraxel@redhat.com > Sent: Monday, March 20, 2023 11:00 PM > To: devel@edk2.groups.io; Yao, Jiewen > Cc: Pawel Polawski ; Wang, Jian J > ; Oliver Steffen ; Xu, Min M > ; Marvin H=E4user ; > jmaloy@redhat.com > Subject: Re: [edk2-devel] [PATCH v2 1/1] > SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable= 2 >=20 > On Mon, Mar 20, 2023 at 01:20:29PM +0000, Yao, Jiewen wrote: > > Would you please share with us what test has been done for this patch? >=20 > Usual regression testing, including booting images with and without > secure boot. Additionally checked images with the wrong signature > are rejected (try boot grub.efi directly instead of using the > shim.efi -> grub.efi chain). >=20 > take care, > Gerd >=20 > > > > Thank you > > Yao, Jiewen > > > > > -----Original Message----- > > > From: devel@edk2.groups.io On Behalf Of Gerd > > > Hoffmann > > > Sent: Monday, March 20, 2023 6:02 PM > > > To: devel@edk2.groups.io > > > Cc: Pawel Polawski ; Wang, Jian J > > > ; Oliver Steffen ; Xu, > Min M > > > ; Marvin H=E4user ; Yao, > > > Jiewen ; jmaloy@redhat.com > > > Subject: Re: [edk2-devel] [PATCH v2 1/1] > > > SecurityPkg/DxeImageVerificationLib: Check result of > GetEfiGlobalVariable2 > > > > > > On Fri, Mar 03, 2023 at 11:35:53AM +0100, Gerd Hoffmann wrote: > > > > Call gRT->GetVariable() directly to read the SecureBoot variable. = It is > > > > one byte in size so we can easily place it on the stack instead of > > > > having GetEfiGlobalVariable2() allocate it for us, which avoids a f= ew > > > > possible error cases. > > > > > > > > Skip secure boot checks if (and only if): > > > > > > > > (a) the SecureBoot variable is not present (EFI_NOT_FOUND) accordi= ng > to > > > > the return value, or > > > > (b) the SecureBoot variable was read successfully and is set to > > > > SECURE_BOOT_MODE_DISABLE. > > > > > > > > Previously the code skipped the secure boot checks on *any* > > > > gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable > > > > value to NULL in that case) and also on memory allocation failures. > > > > > > > > Fixes: CVE-2019-14560 > > > > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2167 > > > > Signed-off-by: Gerd Hoffmann > > > > > > Ping. Any comments on this patch? > > > > > > take care, > > > Gerd > > > > > > > > > > > > > > > > > > > > > > >=20 > > > > >=20 > --