Re: [PATCH v2 0/2] MdeModulePkg: Resolve buffer cross boundary access in Ramdisk

[Laszlo Ersek <lersek@redhat.com>]

On 02/26/19 08:45, Hao Wu wrote:
> V2 changes:
> 
> Correct CC list information.
> 
> 
> V1 history:
> 
> The series will resolve a buffer cross boundary access issue during the
> use of RAM disks. It is the mitigation for issue CVE-2018-12180.
> 
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Star Zeng <star.zeng@intel.com>
> 
> Hao Wu (2):
>   MdeModulePkg/PartitionDxe: Ensure blocksize can hold MBR (CVE FIX)
>   MdeModulePkg/RamDiskDxe: Ramdisk size be multiple of BlkSize (CVE FIX)
> 
>  MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h     |  6 +++---
>  MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c           |  9 ++++++++-
>  MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c           |  9 ++++++++-
>  MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c  | 20 ++++++++++++++------
>  MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c |  5 +++--
>  5 files changed, 36 insertions(+), 13 deletions(-)
> 

Please put the exact CVE numbers in the subject lines.

Thanks
Laszlo