From nobody Mon Feb 9 01:57:15 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+54332+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+54332+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 158156661165453.588992984269; Wed, 12 Feb 2020 20:03:31 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id Ae17YY1788612xfpGo6ebEP6; Wed, 12 Feb 2020 20:03:30 -0800 X-Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by mx.groups.io with SMTP id smtpd.web10.1639.1581566610064274437 for ; Wed, 12 Feb 2020 20:03:30 -0800 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga106.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 12 Feb 2020 20:03:29 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,434,1574150400"; d="scan'208";a="380976067" X-Received: from shwdeopenpsi114.ccr.corp.intel.com ([10.239.157.126]) by orsmga004.jf.intel.com with ESMTP; 12 Feb 2020 20:03:28 -0800 From: "Dandan Bi" To: devel@edk2.groups.io Cc: Liming Gao , Eric Dong , Jian J Wang Subject: [edk2-devel] [patch] MdeModulePkg/HiiDB: Remove configuration table when it's freed (CVE-2019-14586) Date: Thu, 13 Feb 2020 12:03:01 +0800 Message-Id: <20200213040303.53336-1-dandan.bi@intel.com> Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,dandan.bi@intel.com X-Gm-Message-State: rrrJ8IbSg6Q0au5eeG1x6k8Ex1787277AA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1581566610; bh=MOtqQ/ERHDeLo5Izlb+jUl6/t2ux+D6tJY3Wthu/Tbw=; h=Cc:Date:From:Reply-To:Subject:To; b=IvoSsx5/kAWRwoy6iJiYm5JzsvNFnFnqEF0PcZOHoQC/B4Vx0mO+519kxgneYRgjY5z nKr7YwzF3b2Q7mirSxS/+IjMjHjUC2F5+Ba1ZC4yoR44/wV4CX4QVT257LSVUKeNHv73/ dSLH/0Un01OTKWNUXAgUIGqGAZ0h2o54j7o= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1995 Fix the corner case issue that the original configuration runtime memory is freed, but it is still exposed to the OS runtime. So this patch is to remove the configuration table to avoid being used in OS runtime when the configuration runtime memory is freed. Cc: Liming Gao Cc: Eric Dong Cc: Jian J Wang Signed-off-by: Dandan Bi Reviewed-by: Eric Dong Reviewed-by: Jian J Wang --- MdeModulePkg/Universal/HiiDatabaseDxe/Database.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/MdeModulePkg/Universal/HiiDatabaseDxe/Database.c b/MdeModulePk= g/Universal/HiiDatabaseDxe/Database.c index d3791ca68b..36265b8ff9 100644 --- a/MdeModulePkg/Universal/HiiDatabaseDxe/Database.c +++ b/MdeModulePkg/Universal/HiiDatabaseDxe/Database.c @@ -3374,10 +3374,14 @@ HiiGetConfigRespInfo( } gRTConfigRespBuffer =3D (EFI_STRING) AllocateRuntimeZeroPool (gConfi= gRespSize); if (gRTConfigRespBuffer =3D=3D NULL){ FreePool(ConfigAltResp); DEBUG ((DEBUG_ERROR, "[HiiDatabase]: No enough memory resource to = store the ConfigResp string.\n")); + // + // Remove from the System Table when the configuration runtime buf= fer is freed. + // + gBS->InstallConfigurationTable (&gEfiHiiConfigRoutingProtocolGuid,= NULL); return EFI_OUT_OF_RESOURCES; } } else { ZeroMem(gRTConfigRespBuffer,gConfigRespSize); } @@ -3429,10 +3433,14 @@ HiiGetDatabaseInfo( DEBUG ((DEBUG_WARN, "[HiiDatabase]: Memory allocation is required af= ter ReadyToBoot, which may change memory map and cause S4 resume issue.\n")= ); } gRTDatabaseInfoBuffer =3D AllocateRuntimeZeroPool (gDatabaseInfoSize); if (gRTDatabaseInfoBuffer =3D=3D NULL){ DEBUG ((DEBUG_ERROR, "[HiiDatabase]: No enough memory resource to st= ore the HiiDatabase info.\n")); + // + // Remove from the System Table when the configuration runtime buffe= r is freed. + // + gBS->InstallConfigurationTable (&gEfiHiiDatabaseProtocolGuid, NULL); return EFI_OUT_OF_RESOURCES; } } else { ZeroMem(gRTDatabaseInfoBuffer,gDatabaseInfoSize); } --=20 2.18.0.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#54332): https://edk2.groups.io/g/devel/message/54332 Mute This Topic: https://groups.io/mt/71232485/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-