Re: [PATCH v2 1/1] SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2

["Min Xu" <min.m.xu@intel.com>]

It's good to me.
Reviewed-by: Min Xu <min.m.xu@intel.com>

Thanks

> -----Original Message-----
> From: Gerd Hoffmann <kraxel@redhat.com>
> Sent: Monday, March 20, 2023 6:02 PM
> To: devel@edk2.groups.io
> Cc: Pawel Polawski <ppolawsk@redhat.com>; Wang, Jian J
> <jian.j.wang@intel.com>; Oliver Steffen <osteffen@redhat.com>; Xu, Min M
> <min.m.xu@intel.com>; Marvin Häuser <mhaeuser@posteo.de>; Yao, Jiewen
> <jiewen.yao@intel.com>; jmaloy@redhat.com
> Subject: Re: [PATCH v2 1/1] SecurityPkg/DxeImageVerificationLib: Check
> result of GetEfiGlobalVariable2
> 
> On Fri, Mar 03, 2023 at 11:35:53AM +0100, Gerd Hoffmann wrote:
> > Call gRT->GetVariable() directly to read the SecureBoot variable.  It
> > is one byte in size so we can easily place it on the stack instead of
> > having GetEfiGlobalVariable2() allocate it for us, which avoids a few
> > possible error cases.
> >
> > Skip secure boot checks if (and only if):
> >
> >  (a) the SecureBoot variable is not present (EFI_NOT_FOUND) according to
> >      the return value, or
> >  (b) the SecureBoot variable was read successfully and is set to
> >      SECURE_BOOT_MODE_DISABLE.
> >
> > Previously the code skipped the secure boot checks on *any*
> > gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable
> > value to NULL in that case) and also on memory allocation failures.
> >
> > Fixes: CVE-2019-14560
> > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=2167
> > Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
> 
> Ping.  Any comments on this patch?
> 
> take care,
>   Gerd