On Thu, 11 Jan 2024 at 06:15, <gua.guo@intel.com> wrote:
>
> From: Gerd Hoffmann <kraxel@redhat.com>
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
>
> Fix integer overflow in various CreateHob instances.
> Fixes: CVE-2022-36765
>
> The CreateHob() function aligns the requested size to 8
> performing the following operation:
> ```
> HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
> ```
>
> No checks are performed to ensure this value doesn't
> overflow, and could lead to CreateHob() returning a smaller
> HOB than requested, which could lead to OOB HOB accesses.
>
> Reported-by: Marc Beatove <mbeatove@google.com>
> Cc: Leif Lindholm <quic_llindhol@quicinc.com>
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> Cc: Abner Chang <abner.chang@amd.com>
> Cc: John Mathew <john.mathews@intel.com>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This is missing a signed-off line from the sender.
(the signoff is not a statement of authorship, it is a promise by the
sender that the contribution complies with the license)
With that fixed:
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
> ---
> EmbeddedPkg/Library/PrePiHobLib/Hob.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/EmbeddedPkg/Library/PrePiHobLib/Hob.c b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
> index 8eb175aa96..ee2e3176be 100644
> --- a/EmbeddedPkg/Library/PrePiHobLib/Hob.c
> +++ b/EmbeddedPkg/Library/PrePiHobLib/Hob.c
> @@ -110,6 +110,12 @@ CreateHob (
>
> HandOffHob = GetHobList ();
>
> + //
> + // Check Length to avoid data overflow.
> + //
> + if (HobLength > MAX_UINT16 - 0x7) {
> + return NULL;
> + }
> HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
>
> FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
> --
> 2.39.2.windows.1
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#113584): https://edk2.groups.io/g/devel/message/113584
Mute This Topic: https://groups.io/mt/103657273/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-