From nobody Fri May 17 05:54:40 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+113577+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113577+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1704950133; cv=none; d=zohomail.com; s=zohoarc; b=CVWFxL4O1XFex+egr6skgPnsGlD7NmKvBZZXuEQv1dj3c/jLDv2/Mtp+37nZ5HBTQFIekiwmc4QXTPTK+g6Bfj67EjRFicwe9HY6yDkU+6ZBb5smsIQXzDyaW6bxPlH6gz5Ph5YW8LELD22Zg2GVJAvUIIrcby/JUlKX8oalTd4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1704950133; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=5zd2l1O3xDiP2KMu/rO7Vc35KTTdhP7funUUCKRNNJU=; b=RFnNWyssIH97HwO+eqI2Uy1fy/sKDXomipEmvLNMcP/LTVui1XqfITOAOm9tbvNd5NgFmEj15HBnHzzfy6aLleGgZKnhXGeqEniOXO0fPJv6sMRPOv6j8an717O9gxmt8Y9ioZObu2ML35zUJIm0Nu1Hb3gZjfiK/4wfOQzdYM4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113577+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 170495013306825.459694683493694; Wed, 10 Jan 2024 21:15:33 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=dSSMXxl3JNH17WsqxEhqiNhUbhn+xi8gXvJFkVfOd3E=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1704950132; v=1; b=NGXcPRBX0sToJUYdHcq3ce/MDq21C++mGLSBSQRe4/S4WiSli+2aqQQqrJCNdSVs/zj3wsuN +eYACwDwbfPTBJi/qulPe0qpNHoJVmK2ALjhYP68R5/IK8H6gKWAE47Ct+wzGcyYlFF6F0pecRm sIuB+x2SulzRZhYU/IvW2I4o= X-Received: by 127.0.0.2 with SMTP id rUnKYY1788612xN2Q8Rx9LGG; Wed, 10 Jan 2024 21:15:32 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) by mx.groups.io with SMTP id smtpd.web10.5391.1704950130183224811 for ; Wed, 10 Jan 2024 21:15:32 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="12229104" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="12229104" X-Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jan 2024 21:15:31 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="955624802" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="955624802" X-Received: from gguo-desk.gar.corp.intel.com ([10.225.76.26]) by orsmga005.jf.intel.com with ESMTP; 10 Jan 2024 21:15:29 -0800 From: "Guo, Gua" To: devel@edk2.groups.io Cc: gua.guo@intel.com, Gerd Hoffmann , Marc Beatove , Guo Dong , Sean Rhodes , James Lu , John Mathew Subject: [edk2-devel] [PATCH v1 1/4] UefiPayloadPkg/Hob: Integer Overflow in CreateHob() Date: Thu, 11 Jan 2024 13:15:18 +0800 Message-Id: <20240111051521.1366-2-gua.guo@intel.com> In-Reply-To: <20240111051521.1366-1-gua.guo@intel.com> References: <20240111051521.1366-1-gua.guo@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gua.guo@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: jMtWpt29r7BXLYEYkW014jZ7x1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1704950133872100005 Content-Type: text/plain; charset="utf-8" From: Gerd Hoffmann REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4166 Fix integer overflow in various CreateHob instances. Fixes: CVE-2022-36765 The CreateHob() function aligns the requested size to 8 performing the following operation: ``` HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); ``` No checks are performed to ensure this value doesn't overflow, and could lead to CreateHob() returning a smaller HOB than requested, which could lead to OOB HOB accesses. Reported-by: Marc Beatove Cc: Guo Dong Cc: Sean Rhodes Cc: James Lu Reviewed-by: Gua Guo Cc: John Mathew Signed-off-by: Gerd Hoffmann --- UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c b/UefiPayloadP= kg/Library/PayloadEntryHobLib/Hob.c index 2c3acbbc19..f2bd2650b6 100644 --- a/UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c +++ b/UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c @@ -110,6 +110,12 @@ CreateHob ( =20 HandOffHob =3D GetHobList (); =20 + // + // Check Length to avoid data overflow. + // + if (HobLength > MAX_UINT16 - 0x7) { + return NULL; + } HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); =20 FreeMemory =3D HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryB= ottom; --=20 2.39.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113577): https://edk2.groups.io/g/devel/message/113577 Mute This Topic: https://groups.io/mt/103657271/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:54:40 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+113578+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113578+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1704950136; cv=none; d=zohomail.com; s=zohoarc; b=VY+I8/BTIobcA/cErI9esRAsc25fkhGYwDK/fBXsDUDN/fzPGa68IFFhp3GXy8K2r/BWvMjneloAtZggqbMNjBZtnErrPxzlBHfiR+MHagp2/quJaZ4wpHtY9py/cg06WMRSnFxEpIAoQOUZa0AvOfr3IfcpOHS78lYSADfyT3c= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1704950136; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=sad7vZcn/IytOk3TGuwInBEfDiYrI7G4Uhhg3EsFGF0=; b=XsSziA9uvtsfJMPs7jAo61cSjzURxv4aRFK+ISLzNsQZ1wIjNRrjLO2ddF8dcelgwTwr5x8o6sQYNOxZcqB2enJlk4UZ1Ar6lVyFisBEd85zVBLZ8EzkbSM5oxGS7RDmExKuL610PLZ3ek2w+3Dt6UIPr0OQHatMqKxmFbPG/Uc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113578+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1704950136709402.87984233966665; Wed, 10 Jan 2024 21:15:36 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=tyF8zYrokkqAA1a4HWxoevYHfyWrUd2NH479UU2M5oM=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1704950136; v=1; b=EtLcCmsUhNoJdmpGNju10+MtQAZpqlvYUPIOaoxcYK/ngUbg1xzNQcsFzJgebZX66Y5Tvyaz Ol0jlZlveSt9wdReZhtHoNVctZnBUUXH7lv3wJwz3qYm8O61K6XG8QPHH9d8AK1ToFD9sn7tGlP BbPyMaBELMxF8E4kWeqGhHX4= X-Received: by 127.0.0.2 with SMTP id wnfwYY1788612xeO5Oe4Cm6B; Wed, 10 Jan 2024 21:15:36 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) by mx.groups.io with SMTP id smtpd.web10.5391.1704950130183224811 for ; Wed, 10 Jan 2024 21:15:35 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="12229112" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="12229112" X-Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jan 2024 21:15:34 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="955624819" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="955624819" X-Received: from gguo-desk.gar.corp.intel.com ([10.225.76.26]) by orsmga005.jf.intel.com with ESMTP; 10 Jan 2024 21:15:31 -0800 From: "Guo, Gua" To: devel@edk2.groups.io Cc: gua.guo@intel.com, Gerd Hoffmann , Marc Beatove , Ard Biesheuvel , Sami Mujawar , Ray Ni , John Mathew Subject: [edk2-devel] [PATCH v1 2/4] StandaloneMmPkg/Hob: Integer Overflow in CreateHob() Date: Thu, 11 Jan 2024 13:15:19 +0800 Message-Id: <20240111051521.1366-3-gua.guo@intel.com> In-Reply-To: <20240111051521.1366-1-gua.guo@intel.com> References: <20240111051521.1366-1-gua.guo@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gua.guo@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: 0Kaue2tNtSaSXxAkFgX3tIhfx1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1704950137781100001 Content-Type: text/plain; charset="utf-8" From: Gerd Hoffmann REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4166 Fix integer overflow in various CreateHob instances. Fixes: CVE-2022-36765 The CreateHob() function aligns the requested size to 8 performing the following operation: ``` HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); ``` No checks are performed to ensure this value doesn't overflow, and could lead to CreateHob() returning a smaller HOB than requested, which could lead to OOB HOB accesses. Reported-by: Marc Beatove Cc: Ard Biesheuvel Cc: Sami Mujawar Cc: Ray Ni Cc: John Mathew Signed-off-by: Gerd Hoffmann Reviewed-by: Ard Biesheuvel --- .../StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneM= mCoreHobLib.c b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/Standalo= neMmCoreHobLib.c index 1550e1babc..29ade2e4ef 100644 --- a/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHo= bLib.c +++ b/StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHo= bLib.c @@ -34,6 +34,12 @@ CreateHob ( =20 HandOffHob =3D GetHobList (); =20 + // + // Check Length to avoid data overflow. + // + if (HobLength > MAX_UINT16 - 0x7) { + return NULL; + } HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); =20 FreeMemory =3D HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryB= ottom; --=20 2.39.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113578): https://edk2.groups.io/g/devel/message/113578 Mute This Topic: https://groups.io/mt/103657272/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:54:40 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+113579+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113579+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1704950138; cv=none; d=zohomail.com; s=zohoarc; b=Bl35Nlc0v3JANOpu4sN50ZY5AvgpDVacqS+DkB+hXHTi9j3lWQ9a2R1yH+YquWFT0xZODKX+jzfCgASxGTFLX082owPM1lM73WYyiI2DgCXdC0DWvsMirjHV3pIfm9xFK6GJrLltrAELYMnk+WL3ZyADHYrQV2FQBhXSFiVYW7k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1704950138; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=HmCkIBSUQF5FhoamIjstVKykmT3QSxJG2I8jR+0INhQ=; b=Yy1QHU4ErpgH7RR1wE5zzlyj46eTpfr6jTcE5nfccqPyXYYrLRqkqUhKziD5vs9HPL/OJGBn5lGXgE5VNyg7tEHnIb9RFeCpHYlhagOXnsGY7EqBNnXamfTql5N2CybN/X+aXtf/W3QbAnkcHg2k+YPcJcIyvJssDHY4ns7GqDw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113579+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1704950138107170.84669456870427; Wed, 10 Jan 2024 21:15:38 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=X0weEYy8zBtSAEVBrlnI2WeBEHgQxlezy5obxMq8Rog=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1704950137; v=1; b=dhhtmoQ2PqEyQDaHdWM8l1yyJ0eoTOXLoStFGnPz4F4ZaceLeSBbJ5+5zCv9MD8lsYUdfTek s2bRpLL9BQJVx7w9CgL7YnPm4lC4jTBEp67hBPIviGsb9A7+nySmHpReiY/oiuEQOCTOSqtUUbD 3eFhdVkACVGcOlZ8n3Wp8lsw= X-Received: by 127.0.0.2 with SMTP id vQq4YY1788612x9Z2Yktckfg; Wed, 10 Jan 2024 21:15:37 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) by mx.groups.io with SMTP id smtpd.web10.5391.1704950130183224811 for ; Wed, 10 Jan 2024 21:15:37 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="12229130" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="12229130" X-Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jan 2024 21:15:36 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="955624837" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="955624837" X-Received: from gguo-desk.gar.corp.intel.com ([10.225.76.26]) by orsmga005.jf.intel.com with ESMTP; 10 Jan 2024 21:15:34 -0800 From: "Guo, Gua" To: devel@edk2.groups.io Cc: gua.guo@intel.com, Gerd Hoffmann , Marc Beatove , Leif Lindholm , Ard Biesheuvel , Abner Chang , John Mathew Subject: [edk2-devel] [PATCH v1 3/4] EmbeddedPkg/Hob: Integer Overflow in CreateHob() Date: Thu, 11 Jan 2024 13:15:20 +0800 Message-Id: <20240111051521.1366-4-gua.guo@intel.com> In-Reply-To: <20240111051521.1366-1-gua.guo@intel.com> References: <20240111051521.1366-1-gua.guo@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gua.guo@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: CqByaR8tysltmF8PlCC29RJ7x1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1704950139758100007 Content-Type: text/plain; charset="utf-8" From: Gerd Hoffmann REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4166 Fix integer overflow in various CreateHob instances. Fixes: CVE-2022-36765 The CreateHob() function aligns the requested size to 8 performing the following operation: ``` HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); ``` No checks are performed to ensure this value doesn't overflow, and could lead to CreateHob() returning a smaller HOB than requested, which could lead to OOB HOB accesses. Reported-by: Marc Beatove Cc: Leif Lindholm Cc: Ard Biesheuvel Cc: Abner Chang Cc: John Mathew Signed-off-by: Gerd Hoffmann Reviewed-by: Ard Biesheuvel --- EmbeddedPkg/Library/PrePiHobLib/Hob.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/EmbeddedPkg/Library/PrePiHobLib/Hob.c b/EmbeddedPkg/Library/Pr= ePiHobLib/Hob.c index 8eb175aa96..ee2e3176be 100644 --- a/EmbeddedPkg/Library/PrePiHobLib/Hob.c +++ b/EmbeddedPkg/Library/PrePiHobLib/Hob.c @@ -110,6 +110,12 @@ CreateHob ( =20 HandOffHob =3D GetHobList (); =20 + // + // Check Length to avoid data overflow. + // + if (HobLength > MAX_UINT16 - 0x7) { + return NULL; + } HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); =20 FreeMemory =3D HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryB= ottom; --=20 2.39.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113579): https://edk2.groups.io/g/devel/message/113579 Mute This Topic: https://groups.io/mt/103657273/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Fri May 17 05:54:40 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+113580+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113580+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1704950140; cv=none; d=zohomail.com; s=zohoarc; b=mFR2JD+Bx25nkRBp3YXQam8URMtdNP8CSSacPOXESeSkscZeTKDyd5ukmxsiQVRamO5AMxIwYSSq2+VV+Wc1/ast+FoRYNF4wBlD84GOucDQ38LMafleYf78gyVbXDEKo8M+tbGZUlA8vaRrC+2OmXqKFZzfRh52xjygBcOCvCU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1704950140; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Sender:Subject:Subject:To:To:Message-Id; bh=ZppmIKLtvMH2PS1ETPObsd3czC9MuqZlwku9jvtF3cU=; b=E/QwbO9+p4VFxS6/gwds6llQ6jejO2HoOm9ruzw8ZGwe4VSIJQmtoP3Kma47vUD9lJ6cb9ejagV5zRdcoTxqEVsHeTygqYUjnI7UoY/xgLFec5dvBhbt5GCfPARv2PwqzTiNYFcUvZKYRhAJybiRIVRggj9iqLkRtOMnnORQhdM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+113580+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1704950140018698.0500388079105; Wed, 10 Jan 2024 21:15:40 -0800 (PST) Return-Path: DKIM-Signature: a=rsa-sha256; bh=ghhGDsKSgEtODi0ErmcZ0TCga/M643Yc6tOVCUDpt9w=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20140610; t=1704950139; v=1; b=GpCkUzUm4+WwO3gIbOfDLOt2O0Bwpe1uA8FP+ajZsBqOjUFxXvfeXdtZTs3oqcHWErIY1HdQ ozKOP4PcxQNmNydMZ7CEbfFEKR5h7BZRzQyPrTCrwiYsv/9SScYBU65zr4/zvB8runJRjm382VO v05CAjZO/dVvo7YrGX8dthOw= X-Received: by 127.0.0.2 with SMTP id 9JVHYY1788612x9Nj5x0zZB6; Wed, 10 Jan 2024 21:15:39 -0800 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) by mx.groups.io with SMTP id smtpd.web10.5391.1704950130183224811 for ; Wed, 10 Jan 2024 21:15:39 -0800 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="12229136" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="12229136" X-Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Jan 2024 21:15:38 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10949"; a="955624855" X-IronPort-AV: E=Sophos;i="6.04,185,1695711600"; d="scan'208";a="955624855" X-Received: from gguo-desk.gar.corp.intel.com ([10.225.76.26]) by orsmga005.jf.intel.com with ESMTP; 10 Jan 2024 21:15:36 -0800 From: "Guo, Gua" To: devel@edk2.groups.io Cc: gua.guo@intel.com, Gerd Hoffmann , Marc Beatove , Liming Gao , John Mathew Subject: [edk2-devel] [PATCH v1 4/4] MdeModulePkg/Hob: Integer Overflow in CreateHob() Date: Thu, 11 Jan 2024 13:15:21 +0800 Message-Id: <20240111051521.1366-5-gua.guo@intel.com> In-Reply-To: <20240111051521.1366-1-gua.guo@intel.com> References: <20240111051521.1366-1-gua.guo@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,gua.guo@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: IBmHWNLz2IVFJZcAsMq47eKNx1787277AA= Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1704950141726100011 Content-Type: text/plain; charset="utf-8" From: Gerd Hoffmann REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4166 Fix integer overflow in various CreateHob instances. Fixes: CVE-2022-36765 The CreateHob() function aligns the requested size to 8 performing the following operation: ``` HobLength =3D (UINT16)((HobLength + 0x7) & (~0x7)); ``` No checks are performed to ensure this value doesn't overflow, and could lead to CreateHob() returning a smaller HOB than requested, which could lead to OOB HOB accesses. Reported-by: Marc Beatove Cc: Liming Gao Cc: John Mathew Signed-off-by: Gerd Hoffmann --- MdeModulePkg/Core/Pei/Hob/Hob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MdeModulePkg/Core/Pei/Hob/Hob.c b/MdeModulePkg/Core/Pei/Hob/Ho= b.c index c4882a23cd..985da50995 100644 --- a/MdeModulePkg/Core/Pei/Hob/Hob.c +++ b/MdeModulePkg/Core/Pei/Hob/Hob.c @@ -85,7 +85,7 @@ PeiCreateHob ( // // Check Length to avoid data overflow. // - if (0x10000 - Length <=3D 0x7) { + if (MAX_UINT16 - Length < 0x7) { return EFI_INVALID_PARAMETER; } =20 --=20 2.39.2.windows.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#113580): https://edk2.groups.io/g/devel/message/113580 Mute This Topic: https://groups.io/mt/103657274/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-