From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 410017803CC for ; Fri, 22 Mar 2024 03:51:19 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=VD+cPfunU+dU8QjLmL5vKBJkBdNCMk2Mlz1UCqlC15g=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20240206; t=1711079478; v=1; b=OPrD1FUZOo7Al6OAnINLVmWQewbX7Hp4oFVO1FVe3qZMsY2ggaX0Uyv4hMjFKhv+4WpSKJXZ OKHLLr41t963gtFZDTd1hPAjbSlgQ+j4VCk831JpnWY3+/ZJHIXxeR6/inc409n3HmCo9q+i9/j fOs1dYrUpiRPIkqXx56WtpXPM/e4jQOynvcNaNZJmXtMTC2gG4h+ZsZ4Kvq54uJuo8GmRIRcZ9n ihvR1rb5Jt8bcK9s6ZcWxw4ZAyB9e3p2uhFt766HB6udYmxRoMnun2nb+HRP85quGbTfOju33+N 9fQoHweltf8RoLYrCPMvIbcfP/AL8iOdk889eHtsG8vnA== X-Received: by 127.0.0.2 with SMTP id AK3iYY7687511x5XF3lj9oJJ; Thu, 21 Mar 2024 20:51:18 -0700 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.12]) by mx.groups.io with SMTP id smtpd.web11.5260.1711079477772138834 for ; Thu, 21 Mar 2024 20:51:18 -0700 X-IronPort-AV: E=McAfee;i="6600,9927,11020"; a="9877832" X-IronPort-AV: E=Sophos;i="6.07,144,1708416000"; d="scan'208";a="9877832" X-Received: from fmviesa005.fm.intel.com ([10.60.135.145]) by fmvoesa106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Mar 2024 20:51:17 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.07,144,1708416000"; d="scan'208";a="19215176" X-Received: from pidsbabios017.gar.corp.intel.com ([10.223.9.190]) by fmviesa005-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 21 Mar 2024 20:51:16 -0700 From: "V V, Pranav" To: devel@edk2.groups.io Cc: bhavana.s@intel.com, tabassum.yasmin@intel.com, "V V, Pranav" Subject: [edk2-devel] [PATCH] REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4649 Date: Fri, 22 Mar 2024 09:20:42 +0530 Message-Id: MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Thu, 21 Mar 2024 20:51:18 -0700 Reply-To: devel@edk2.groups.io,pranav.v.v@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: YpTOzm4M81IiT27JUU4rrWpMx7686176AA= Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=OPrD1FUZ; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io The KeyLibGenerateSalt function fails to check the return value of RandomSeed and RandomBytes function calls. SavePasswordToVariable function also fails to check the status of calling function KeyLibGenerateSalt Added a status check for all the above mentioned function's Signed-off-by: V V Pranav --- .../UserAuthenticationDxeSmm/KeyService.c | 8 ++++++-- .../UserAuthenticationDxeSmm/UserAuthenticationSmm.c | 6 +++++- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/KeyService.c b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/KeyService.c index 8b06e58ca5..f0a537e707 100644 --- a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/KeyService.c +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/KeyService.c @@ -78,8 +78,12 @@ KeyLibGenerateSalt ( if (SaltValue == NULL) { return FALSE; } - RandomSeed(NULL, 0); - RandomBytes(SaltValue, SaltSize); + if (!RandomSeed(NULL, 0)) { + return FALSE; + } + if (!RandomBytes(SaltValue, SaltSize)) { + return FALSE; + } return TRUE; } diff --git a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c index 98f40c1812..1efae70e38 100644 --- a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c +++ b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c @@ -221,12 +221,16 @@ SavePasswordToVariable ( EFI_STATUS Status; USER_PASSWORD_VAR_STRUCT UserPasswordVarStruct; BOOLEAN HashOk; + BOOLEAN KeyLibGenerateSaltOk; // // If password is NULL, it means we want to clean password field saved in variable region. // if (Password != NULL) { - KeyLibGenerateSalt (UserPasswordVarStruct.PasswordSalt, sizeof(UserPasswordVarStruct.PasswordSalt)); + KeyLibGenerateSaltOk = KeyLibGenerateSalt (UserPasswordVarStruct.PasswordSalt, sizeof(UserPasswordVarStruct.PasswordSalt)); + if (!KeyLibGenerateSaltOk) { + return EFI_NOT_FOUND; + } HashOk = KeyLibGeneratePBKDF2Hash ( HASH_TYPE_SHA256, (UINT8 *)Password, -- 2.39.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#117023): https://edk2.groups.io/g/devel/message/117023 Mute This Topic: https://groups.io/mt/105079487/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-