From nobody Mon Feb 9 02:28:43 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) client-ip=66.175.222.12; envelope-from=bounce+27952+54423+1787277+3901457@groups.io; helo=web01.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.12 as permitted sender) smtp.mailfrom=bounce+27952+54423+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from web01.groups.io (web01.groups.io [66.175.222.12]) by mx.zohomail.com with SMTPS id 1581665275000252.00118622650018; Thu, 13 Feb 2020 23:27:55 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id Bd2eYY1788612xkHRYoszi8a; Thu, 13 Feb 2020 23:27:54 -0800 X-Received: from mga04.intel.com (mga04.intel.com []) by mx.groups.io with SMTP id smtpd.web11.3343.1581665266656025367 for ; Thu, 13 Feb 2020 23:27:53 -0800 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Feb 2020 23:27:53 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,439,1574150400"; d="scan'208";a="347904231" X-Received: from shwdeopensfp777.ccr.corp.intel.com ([10.239.158.78]) by fmsmga001.fm.intel.com with ESMTP; 13 Feb 2020 23:27:52 -0800 From: "Wang, Jian J" To: devel@edk2.groups.io Cc: Jiewen Yao , Chao Zhang , Laszlo Ersek Subject: [edk2-devel] [PATCH v2 07/10] SecurityPkg/DxeImageVerificationLib: tighten default result(CVE-2019-14575) Date: Fri, 14 Feb 2020 15:27:42 +0800 Message-Id: <20200214072745.1570-8-jian.j.wang@intel.com> In-Reply-To: <20200214072745.1570-1-jian.j.wang@intel.com> References: <20200214072745.1570-1-jian.j.wang@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jian.j.wang@intel.com X-Gm-Message-State: UcyXSPQI0FAYJCizUKtaBdvIx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1581665274; bh=LYuvkFIROC35QbTHrH/xgCAwZKBx3gm8D1MBH6JAbDA=; h=Cc:Date:From:Reply-To:Subject:To; b=Et38tUSs+kFXAnMdgF48ytqA4oxnafAjWifzc9ubkODvzRzJBV99RJ8YBqQhVVQ3Bai eV4JJ2FFrhJLx1Q9eMFjBnyGfzzbqzwFTxKQ5OSBqYSJc5hHcUCLogeRZOnKKU2++fOoI uz/VjC2/N18Zd5UW5sh7kXPF7ktTd2JKx4o= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1608 All intermediate results inside this function will be checked and returned immediately upon any failure or error, like out-of-resource, hash calculation error or certificate retrieval failure. Cc: Jiewen Yao Cc: Chao Zhang Signed-off-by: Jian J Wang Signed-off-by: Laszlo Ersek Reviewed-by: Jiewen Yao --- .../DxeImageVerificationLib/DxeImageVerificationLib.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificati= onLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationL= ib.c index 85261ba7f2..470a0d20ef 100644 --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c @@ -1240,7 +1240,7 @@ IsForbiddenByDbx ( // // Variable Initialization // - IsForbidden =3D FALSE; + IsForbidden =3D TRUE; Data =3D NULL; CertList =3D NULL; CertData =3D NULL; @@ -1257,7 +1257,14 @@ IsForbiddenByDbx ( // DataSize =3D 0; Status =3D gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageS= ecurityDatabaseGuid, NULL, &DataSize, NULL); + ASSERT (EFI_ERROR (Status)); if (Status !=3D EFI_BUFFER_TOO_SMALL) { + if (Status =3D=3D EFI_NOT_FOUND) { + // + // Evidently not in dbx if the database doesn't exist. + // + IsForbidden =3D FALSE; + } return IsForbidden; } Data =3D (UINT8 *) AllocateZeroPool (DataSize); @@ -1374,6 +1381,8 @@ IsForbiddenByDbx ( =20 } =20 + IsForbidden =3D FALSE; + Done: if (Data !=3D NULL) { FreePool (Data); --=20 2.24.0.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#54423): https://edk2.groups.io/g/devel/message/54423 Mute This Topic: https://groups.io/mt/71264905/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-