From nobody Sat May 30 20:11:55 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1776850209; cv=none; d=zohomail.com; s=zohoarc; b=aRZJlvbd7PeD0eZ01OyFTgzD1iEMqPohhrV7EGi3WsemdTdjvs2Qtc/7dEFHcnnrzCAc+qqjL/aYfFhgpGkiRPHXSVefRLICTVkuh5YqZMY1RmIgtZp+MkWDGCTKZHir/bfkXHRsuOz3PHOP9E8GqDzoTOMCEo9lRBTA0VL4ySg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1776850209; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oXM0BYtBJ+OU81xkYbvynrY9rWrN/LL+9+zViB+eWHw=; b=L5xPMHgzORhehhsk/ctpulI/mS/wwGIwDB5ku/uP5uMrZrJUG2uW/GQ4997r6VlfNQ49gjeEqSM3g7RzhYb0ScUxwcVT4FXndoqYjiM6y2y0BMQywd2tUMxOqha+u5ct6SOwsqe7qMPcZfVDXOMWi0Cr/UVAdoDAYBiBBiEpl4Q= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1776850209490622.7189451250574; Wed, 22 Apr 2026 02:30:09 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wFTtb-00042U-7a; Wed, 22 Apr 2026 05:29:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtX-00041T-MQ for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:19 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtW-0007nS-8Z for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:19 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-655-znAoKh2pNuOPJ1ZJUlF9xQ-1; Wed, 22 Apr 2026 05:29:13 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D81171800370; Wed, 22 Apr 2026 09:29:12 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.48.53]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 49FFF180047F; Wed, 22 Apr 2026 09:29:12 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 2C7971801022; Wed, 22 Apr 2026 11:29:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1776850157; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oXM0BYtBJ+OU81xkYbvynrY9rWrN/LL+9+zViB+eWHw=; b=PJgqzkr2svlW+yrLNiU+hxHmCFWaLQAi2A7/ljaph5ahLWqejFH/qMFXFQdZXyxRNJ6hrE fgbWeXnlAf/4Panhw289sauVl188rOJWMyWMtdyeAH051zr/MrULaTL1frCXZLmTpRj2vC XPqKMYqVNQJP4IaeregVVIdIgGVc6l8= X-MC-Unique: znAoKh2pNuOPJ1ZJUlF9xQ-1 X-Mimecast-MFC-AGG-ID: znAoKh2pNuOPJ1ZJUlF9xQ_1776850153 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PATCH 1/6] hw/uefi: fix buffer overruns Date: Wed, 22 Apr 2026 11:29:04 +0200 Message-ID: <20260422092910.444997-2-kraxel@redhat.com> In-Reply-To: <20260422092910.444997-1-kraxel@redhat.com> References: <20260422092910.444997-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1776850212879154100 Content-Type: text/plain; charset="utf-8" The buffer size checks do not consider the mm_header size, simliar to CVE-2026-5744. Factor out the repeated size check to a small helper function, fix the check, update all places to use the new helper. Fixes: CVE-2026-41435 Fixes: db1ecfb473ac ("hw/uefi: add var-service-vars.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann --- hw/uefi/var-service-vars.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c index 5e3907118d4b..24e6516a9cc0 100644 --- a/hw/uefi/var-service-vars.c +++ b/hw/uefi/var-service-vars.c @@ -297,6 +297,17 @@ static size_t uefi_vars_mm_error(mm_header *mhdr, mm_v= ariable *mvar, return sizeof(*mvar); } =20 +static bool check_buffer_size(uefi_vars_state *uv, uint64_t length) +{ + /* uefi_vars_cmd_mm() checks that */ + g_assert(uv->buf_size >=3D sizeof(mm_header)); + + if (uv->buf_size - sizeof(mm_header) < length) { + return false; + } + return true; +} + static size_t uefi_vars_mm_get_variable(uefi_vars_state *uv, mm_header *mh= dr, mm_variable *mvar, void *func) { @@ -344,7 +355,7 @@ static size_t uefi_vars_mm_get_variable(uefi_vars_state= *uv, mm_header *mhdr, if (uadd64_overflow(length, va->data_size, &length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 @@ -414,7 +425,7 @@ uefi_vars_mm_get_next_variable(uefi_vars_state *uv, mm_= header *mhdr, } =20 length =3D sizeof(*mvar) + sizeof(*nv) + var->name_size; - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 @@ -605,7 +616,7 @@ static size_t uefi_vars_mm_variable_info(uefi_vars_stat= e *uv, mm_header *mhdr, uint64_t length; =20 length =3D sizeof(*mvar) + sizeof(*vi); - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 @@ -626,7 +637,7 @@ uefi_vars_mm_get_payload_size(uefi_vars_state *uv, mm_h= eader *mhdr, uint64_t length; =20 length =3D sizeof(*mvar) + sizeof(*ps); - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 --=20 2.53.0 From nobody Sat May 30 20:11:55 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1776850221; cv=none; d=zohomail.com; s=zohoarc; b=TJr/anaCgSVwkUD/IwHl8q1qsnghu+UWAI1nhs2Vhllvk4mBcl/k7o08wTYuYUwwjr8Z3hmido35N7xDShlhs5mSORm5GbEXdOjyXozbRXTnOwWo95jvh8Tsvs2BWiOvNe6z4bM+y7OldzGYoFhHNiKweXbOkJ+CsSSiaMsb6SM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1776850221; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=iAIhx+eknpPypj9xxQeslr/Qb9BEK/gelulIMZV9Ehc=; b=iyrqOGwPbd3SxuNCQU8q0hHy4o+MI2b9x9EwHUAIlNeAa36wj+WBHhJRFBk8o8Rc+Erbb2JBpeCENeAm/dN134ZOjq1058eh9PNdqj/XH10o3Rf1k+r3IZe7P70yoHbVbndEYJNiBUXplgA1NhXENrzP6xeUOk7xL8jjwThsYhM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1776850221501406.395365838814; Wed, 22 Apr 2026 02:30:21 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wFTtc-00043S-AK; Wed, 22 Apr 2026 05:29:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTta-000422-Jp for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:22 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtY-0007nz-Rr for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:22 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-400-XpRkL6RqNv6DjlFUpPZfbQ-1; Wed, 22 Apr 2026 05:29:16 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 50CC3180036E; Wed, 22 Apr 2026 09:29:15 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.48.53]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D784E180045E; Wed, 22 Apr 2026 09:29:14 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 3BE4C1801027; Wed, 22 Apr 2026 11:29:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1776850160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iAIhx+eknpPypj9xxQeslr/Qb9BEK/gelulIMZV9Ehc=; b=AutiqrrH9LJ/ZzRGkecA4SGpARz/jXuKJ2Fqi4NCGUHVHANa9AZ2mWrvhdvcirUg3jT+hW gcaTuvwimP2m7CceBEcdI7TJcqyoWUcD82Dq4ysZJOWNrqPaS8cSe77v8l8DOEg3MxbPX+ F9amVkJv8NcKKqCj7FoAwg1REk63QX0= X-MC-Unique: XpRkL6RqNv6DjlFUpPZfbQ-1 X-Mimecast-MFC-AGG-ID: XpRkL6RqNv6DjlFUpPZfbQ_1776850155 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PATCH 2/6] hw/uefi: verify pio_xfer_offset before calculating buffer checksum Date: Wed, 22 Apr 2026 11:29:05 +0200 Message-ID: <20260422092910.444997-3-kraxel@redhat.com> In-Reply-To: <20260422092910.444997-1-kraxel@redhat.com> References: <20260422092910.444997-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1776850224119158501 Content-Type: text/plain; charset="utf-8" Without that it is possible to do trigger OOB reads by first advancing offset, then making the buffer smaller, finally asking for a checksum. Fixes: CVE-2026-41436 Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann --- hw/uefi/var-service-core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/uefi/var-service-core.c b/hw/uefi/var-service-core.c index 68d7594c0dd6..828d76007318 100644 --- a/hw/uefi/var-service-core.c +++ b/hw/uefi/var-service-core.c @@ -235,6 +235,10 @@ static uint64_t uefi_vars_read(void *opaque, hwaddr ad= dr, unsigned size) uv->pio_xfer_offset +=3D size; break; case UEFI_VARS_REG_PIO_BUFFER_CRC32C: + if (uv->pio_xfer_offset > uv->buf_size) { + retval =3D 0; + break; + } retval =3D crc32c(0xffffffff, uv->pio_xfer_buffer, uv->pio_xfer_of= fset); break; case UEFI_VARS_REG_FLAGS: --=20 2.53.0 From nobody Sat May 30 20:11:55 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1776850238; cv=none; d=zohomail.com; s=zohoarc; b=g76jT0TCsW6GFJdZ5n+vlElu6HRh3opYGpqnX4SLgisNcqR3mrqueWEtW/g42hPXF05b9BD7NIjHPTypwQnkLuG9jjchg2fUsISaOoJbFw5SoQnm3xofXCynk/Md13E0mMVLg9z8z2w7oye0nh5owQoptrelmWo/JQRfhett6ys= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1776850238; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yZNnNmLB5m+01rMbrAyCUvbYI4Dbe4PiimvOk1+8swY=; b=hQkbW5ZhPZIaGPR5LkB7960/OTG983mVUPLFk4JPPU4zfOOBH2o/Po6aPrzJmY/jIMbPQn3/+3yCZ8pHn+GKQPmnllq3Yc7GxgquJavFYRNGo3AOCvC8/24LXU6AGRhKzzitU9r5LBAC+zsiJElbTDJkACCwXjifGBhnZBJyJGo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1776850238381254.69066175240744; Wed, 22 Apr 2026 02:30:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wFTta-000421-Lo; Wed, 22 Apr 2026 05:29:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtZ-00041s-FX for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:21 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtX-0007no-Sk for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:21 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-643-DoMbSNUkPw62ymltfNTwWw-1; Wed, 22 Apr 2026 05:29:16 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 518D118005B6; Wed, 22 Apr 2026 09:29:15 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.48.53]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D7F0A3000C15; Wed, 22 Apr 2026 09:29:14 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 4AFCA180102C; Wed, 22 Apr 2026 11:29:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1776850159; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yZNnNmLB5m+01rMbrAyCUvbYI4Dbe4PiimvOk1+8swY=; b=VR3KjFQuNATnjLiA8EEc5C+hCDHZJ8Oftqjg6ILdoVzmGmRRES1Ee8N41c03TveDvpZN0K bMXWq0dg9h7vnf+gUe59/aOCqvJl0J77r3E1wcU4V9J+PtaopOz1jIgVnEZcGSeTKsc/P/ 0Dn+r4AH4ZFiO5K7SawS9iwaDNvmpI0= X-MC-Unique: DoMbSNUkPw62ymltfNTwWw-1 X-Mimecast-MFC-AGG-ID: DoMbSNUkPw62ymltfNTwWw_1776850155 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PATCH 3/6] hw/uefi: fix ucs2 string helper functions Date: Wed, 22 Apr 2026 11:29:06 +0200 Message-ID: <20260422092910.444997-4-kraxel@redhat.com> In-Reply-To: <20260422092910.444997-1-kraxel@redhat.com> References: <20260422092910.444997-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1776850240145158500 Content-Type: text/plain; charset="utf-8" The length passed in is in bytes not characters. Rename the parameters to make that clear. Calculate the number of chars if needed. Fix length checks to use the number of chars not bytes to avoid OOB reads. Fixes: CVE-2026-41437 Fixes: 1ebc319c8ca7 ("hw/uefi: add var-service-utils.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann --- hw/uefi/var-service-utils.c | 42 +++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 18 deletions(-) diff --git a/hw/uefi/var-service-utils.c b/hw/uefi/var-service-utils.c index 258013f436af..489321a26ccb 100644 --- a/hw/uefi/var-service-utils.c +++ b/hw/uefi/var-service-utils.c @@ -19,13 +19,18 @@ * sometimes when they are not (for example in variable policies). */ =20 -gboolean uefi_str_is_valid(const uint16_t *str, size_t len, +gboolean uefi_str_is_valid(const uint16_t *str, size_t bytes, gboolean must_be_null_terminated) { + size_t chars =3D bytes / 2; size_t pos =3D 0; =20 + if ((bytes % 2) !=3D 0) { + return false; + } + for (;;) { - if (pos =3D=3D len) { + if (pos =3D=3D chars) { if (must_be_null_terminated) { return false; } else { @@ -47,12 +52,13 @@ gboolean uefi_str_is_valid(const uint16_t *str, size_t = len, } } =20 -size_t uefi_strlen(const uint16_t *str, size_t len) +size_t uefi_strlen(const uint16_t *str, size_t bytes) { + size_t chars =3D bytes / 2; size_t pos =3D 0; =20 for (;;) { - if (pos =3D=3D len) { + if (pos =3D=3D chars) { return pos; } if (str[pos] =3D=3D 0) { @@ -62,25 +68,25 @@ size_t uefi_strlen(const uint16_t *str, size_t len) } } =20 -gboolean uefi_str_equal_ex(const uint16_t *a, size_t alen, - const uint16_t *b, size_t blen, +gboolean uefi_str_equal_ex(const uint16_t *a, size_t a_bytes, + const uint16_t *b, size_t b_bytes, gboolean wildcards_in_a) { + size_t a_chars =3D a_bytes / 2; + size_t b_chars =3D b_bytes / 2; size_t pos =3D 0; =20 - alen =3D alen / 2; - blen =3D blen / 2; for (;;) { - if (pos =3D=3D alen && pos =3D=3D blen) { + if (pos =3D=3D a_chars && pos =3D=3D b_chars) { return true; } - if (pos =3D=3D alen && b[pos] =3D=3D 0) { + if (pos =3D=3D a_chars && b[pos] =3D=3D 0) { return true; } - if (pos =3D=3D blen && a[pos] =3D=3D 0) { + if (pos =3D=3D b_chars && a[pos] =3D=3D 0) { return true; } - if (pos =3D=3D alen || pos =3D=3D blen) { + if (pos =3D=3D a_chars || pos =3D=3D b_chars) { return false; } if (a[pos] =3D=3D 0 && b[pos] =3D=3D 0) { @@ -100,18 +106,18 @@ gboolean uefi_str_equal_ex(const uint16_t *a, size_t = alen, } } =20 -gboolean uefi_str_equal(const uint16_t *a, size_t alen, - const uint16_t *b, size_t blen) +gboolean uefi_str_equal(const uint16_t *a, size_t a_bytes, + const uint16_t *b, size_t b_bytes) { - return uefi_str_equal_ex(a, alen, b, blen, false); + return uefi_str_equal_ex(a, a_bytes, b, b_bytes, false); } =20 -char *uefi_ucs2_to_ascii(const uint16_t *ucs2, uint64_t ucs2_size) +char *uefi_ucs2_to_ascii(const uint16_t *ucs2, uint64_t ucs2_bytes) { - char *str =3D g_malloc0(ucs2_size / 2 + 1); + char *str =3D g_malloc0(ucs2_bytes / 2 + 1); int i; =20 - for (i =3D 0; i * 2 < ucs2_size; i++) { + for (i =3D 0; i * 2 < ucs2_bytes; i++) { if (ucs2[i] =3D=3D 0) { break; } --=20 2.53.0 From nobody Sat May 30 20:11:55 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1776850238; cv=none; d=zohomail.com; s=zohoarc; b=RIWQ/R1NbK/c/damczQwz/Agu1oU1VSbFi3xpzksB5GJ5iS/wYGy+8jpV0J4z+GcyGss8U7fg85HKCV6vpchLBEJ0BBCLxc4PqamMs6Z6t1bG5hVy+gkugnvM52bZhDrDNKGjO4xRe6bz2tO1+XOq/r235ouYeBDz73xnQx3dao= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1776850238; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=o8Wog/zASyqMNyMHu1/jjwJes0eUIXzrD5Poy02nObg=; b=Qn7SM/1o0tWIJP5/nFVmEz/Q3jHcUcAQX6vtQoz6jB43fJYtjYHAYfSpUqvJ2AjqfdV/DXlBTUXAIgbTAFPzWaGsTjCTwjjY2xUViLrykhlXYcdfvdUny0j6hvmdS8mb3GEMX5XVF1GUyaLdQ1CwcOSE6ShnKp2JfZ2qBgQ7sFM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1776850238431607.0099106701853; Wed, 22 Apr 2026 02:30:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wFTtf-000454-KL; Wed, 22 Apr 2026 05:29:27 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtc-00043p-HS for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:24 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtb-0007od-6h for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:24 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-615-RD_LWhThPbuiu1Sy2SsDZw-1; Wed, 22 Apr 2026 05:29:18 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C902D180057D; Wed, 22 Apr 2026 09:29:17 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.48.53]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8A0323000C21; Wed, 22 Apr 2026 09:29:17 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 59B22180102D; Wed, 22 Apr 2026 11:29:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1776850162; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=o8Wog/zASyqMNyMHu1/jjwJes0eUIXzrD5Poy02nObg=; b=jFCpEd9SUD6Duhk1O1tAmEQS5OARiN7Crl9wjsVg3RgVJXytQLOTvCvPTIeEBvkorElsOU YPMF38Yf0UVBdrRgN+4seKm5yMUDEb/Kx8Y4jS3zukNMPeFxSfRsxzfI8NoOzFdjEX5zOI WZmBlsrDvtVcAC96L7R08HwQAlm8YhE= X-MC-Unique: RD_LWhThPbuiu1Sy2SsDZw-1 X-Mimecast-MFC-AGG-ID: RD_LWhThPbuiu1Sy2SsDZw_1776850157 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PATCH 4/6] hw/uefi: add name_size check to uefi_vars_mm_lock_variable() Date: Wed, 22 Apr 2026 11:29:07 +0200 Message-ID: <20260422092910.444997-5-kraxel@redhat.com> In-Reply-To: <20260422092910.444997-1-kraxel@redhat.com> References: <20260422092910.444997-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1776850240105158501 Content-Type: text/plain; charset="utf-8" Make sure the total variable_policy_entry size stays below 64k so the (16-bit) size field can not wrap. Fixes: CVE-2026-41438 Fixes: db1ecfb473ac ("hw/uefi: add var-service-vars.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann --- hw/uefi/var-service-vars.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c index 24e6516a9cc0..2c83130ebf63 100644 --- a/hw/uefi/var-service-vars.c +++ b/hw/uefi/var-service-vars.c @@ -667,6 +667,9 @@ uefi_vars_mm_lock_variable(uefi_vars_state *uv, mm_head= er *mhdr, if (mhdr->length < length) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } + if (sizeof(*pe) + lv->name_size > UINT16_MAX) { + return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); + } =20 uefi_trace_variable(__func__, lv->guid, name, lv->name_size); =20 --=20 2.53.0 From nobody Sat May 30 20:11:55 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1776850238; cv=none; d=zohomail.com; s=zohoarc; b=G6m0SZ1pDHKVJhYZrK/rpPCa5FnDwu0ncXJDO0lw+i5Cp3g4k3vlcoq3FJEX0F88aSbN4cPi3vgYS+jpVYwXi9R+uy1aT3kfpD8BWUkwxkeBhjhu8/K0YVnGbL/IVuYX7O2VAN7dtY7mmSSV2UPZw9m8Ou67CCh6ksK/fQ695Hk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1776850238; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Ji1P0a3pA310Szub8UOWXHzkAOd3IPdmmfNAKWsH9k4=; b=iIG7fOiXDl+X5Ohoy7zT7Ygx5DnzD3Nc7Cm1+dQxkxKBHtOsdAXGF8BTctJyAEunwc+jWh7GBqY2c1BN3GDWO2kBZDYLf81vuhnJj3HGBlmONTuZJBhwZE8xg9ifMpj17RsCpbknht7e7XubNkh/p0sFGAnMw11mmWOXxrGXXfM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1776850238431657.0417913495533; Wed, 22 Apr 2026 02:30:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wFTtc-000447-W1; Wed, 22 Apr 2026 05:29:25 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtb-00043C-U9 for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:23 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTta-0007oe-Lx for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:23 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-80-FvgBiYi_M_au8By4kLDlcQ-1; Wed, 22 Apr 2026 05:29:18 -0400 Received: from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id CEDF01800370; Wed, 22 Apr 2026 09:29:17 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.48.53]) by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 72392180045E; Wed, 22 Apr 2026 09:29:17 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 685251801031; Wed, 22 Apr 2026 11:29:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1776850162; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ji1P0a3pA310Szub8UOWXHzkAOd3IPdmmfNAKWsH9k4=; b=enEfXjb+KQQwn5CkRTI0lkKQyptvbtCZ949n2R8cbTMdvr58L7g98tZh1BuaW3jOyTVGOH ib+055Z1A+9zuUXaYHkM++KIA+MIiEqLY6eXmEfaURFkNz49JQECIn7YwZeX9RrHnwfPCB srvk1EeysTqJGVMrjoCuzlc0Ncd55T0= X-MC-Unique: FvgBiYi_M_au8By4kLDlcQ-1 X-Mimecast-MFC-AGG-ID: FvgBiYi_M_au8By4kLDlcQ_1776850157 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PATCH 5/6] hw/uefi: verify data size before accessing it in wrap_pkcs7 Date: Wed, 22 Apr 2026 11:29:08 +0200 Message-ID: <20260422092910.444997-6-kraxel@redhat.com> In-Reply-To: <20260422092910.444997-1-kraxel@redhat.com> References: <20260422092910.444997-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.111 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1776850240103158500 Content-Type: text/plain; charset="utf-8" Fixes: CVE-2026-41439 Fixes: 3e33af2cb306 ("hw/uefi: add var-service-pkcs7.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann --- hw/uefi/var-service-pkcs7.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/uefi/var-service-pkcs7.c b/hw/uefi/var-service-pkcs7.c index 32accf4e44e0..f17ad6872fd2 100644 --- a/hw/uefi/var-service-pkcs7.c +++ b/hw/uefi/var-service-pkcs7.c @@ -73,7 +73,8 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7) }; gnutls_datum_t wrap; =20 - if (pkcs7->data[4] =3D=3D 0x06 && + if (pkcs7->size > 16 && + pkcs7->data[4] =3D=3D 0x06 && pkcs7->data[5] =3D=3D 0x09 && memcmp(pkcs7->data + 6, signed_data_oid, sizeof(signed_data_oid)) = =3D=3D 0 && pkcs7->data[15] =3D=3D 0x0a && --=20 2.53.0 From nobody Sat May 30 20:11:55 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1776850231; cv=none; d=zohomail.com; s=zohoarc; b=VhYPVy0zrBeUn0xTQFn/8gUBDBkgAqEwVvkE3oE2MJTcD4Ytn7zeWXK9QX1SIfWhCS92ClaWXZT5149HFDu93JMNW/67RrkoiH+e3QT1PCWBNJaaoDyhPIdmo2P9vsWETMbGQdLjveb7nGU5xoYnWIxwk97E2nxku213CaazwH8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1776850231; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gQ81jDtxmHW5yOUxb8N6HXBRdoL8rvnU1AKzIe2hTls=; b=iBT7+hxgrTkLxmR12m4ZUs2Uk0CIIGnnLcfnB65eahsdN6uJWXOxCF/F/9Or1KKT0dBUYcm2Yh0Kp90e/j7PvbA2bl/kAQCyjhHVLwYyngR4Pd98Nq+3trUfHQLyGexlkXflWtgugqwph8asO/D/sl/Xh0Q+G4397qBqr5j+f1k= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1776850231144573.46700069444; Wed, 22 Apr 2026 02:30:31 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wFTtg-00045E-1B; Wed, 22 Apr 2026 05:29:28 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTte-00044p-Ur for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:26 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wFTtd-0007pD-IT for qemu-devel@nongnu.org; Wed, 22 Apr 2026 05:29:26 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-651-eAP9D6Q0N8qPww87yH8u9A-1; Wed, 22 Apr 2026 05:29:21 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 2B6B419560AA; Wed, 22 Apr 2026 09:29:20 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.48.53]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C81203000C15; Wed, 22 Apr 2026 09:29:19 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 774DC1801033; Wed, 22 Apr 2026 11:29:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1776850164; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gQ81jDtxmHW5yOUxb8N6HXBRdoL8rvnU1AKzIe2hTls=; b=RsTZ3IjXtCCa+f/p6KKnapnBXsBzeGgtLWzw6alEwynpJdj7s+pwCn4p3VQedrvnxBbLox hbYHr15kwNu4gP9bTr9/pQt35DHUyO+ijwkOhnFACIOO1OxM4QRgcVdOQcgntsVpOzeMO3 +Sney3AHuoLD363TTjgJULwEXQg/z+Q= X-MC-Unique: eAP9D6Q0N8qPww87yH8u9A-1 X-Mimecast-MFC-AGG-ID: eAP9D6Q0N8qPww87yH8u9A_1776850160 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PATCH 6/6] hw/uefi: avoid possibly unaligned variable_auth_2 struct field access Date: Wed, 22 Apr 2026 11:29:09 +0200 Message-ID: <20260422092910.444997-7-kraxel@redhat.com> In-Reply-To: <20260422092910.444997-1-kraxel@redhat.com> References: <20260422092910.444997-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1776850233940158500 Content-Type: text/plain; charset="utf-8" Copy data to stack-allocated struct before accessing it to make sure it is properly aligned. Fixes: CVE-2026-41440 Fixes: f1488fac0584 ("hw/uefi: add var-service-auth.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann --- hw/uefi/var-service-auth.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c index fba5a0956a57..0d17691804df 100644 --- a/hw/uefi/var-service-auth.c +++ b/hw/uefi/var-service-auth.c @@ -218,23 +218,25 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars= _state *uv, efi_status uefi_vars_check_auth_2(uefi_vars_state *uv, uefi_variable *var, mm_variable_access *va, void *data) { - variable_auth_2 *auth =3D data; + variable_auth_2 auth; uint64_t data_offset; efi_status status; =20 - if (va->data_size < sizeof(*auth)) { + if (va->data_size < sizeof(auth)) { return EFI_SECURITY_VIOLATION; } - if (uadd64_overflow(sizeof(efi_time), auth->hdr_length, &data_offset))= { + memcpy(&auth, data, sizeof(auth)); + + if (uadd64_overflow(sizeof(efi_time), auth.hdr_length, &data_offset)) { return EFI_SECURITY_VIOLATION; } if (va->data_size < data_offset) { return EFI_SECURITY_VIOLATION; } =20 - if (auth->hdr_revision !=3D 0x0200 || - auth->hdr_cert_type !=3D WIN_CERT_TYPE_EFI_GUID || - !qemu_uuid_is_equal(&auth->guid_cert_type, &EfiCertTypePkcs7Guid))= { + if (auth.hdr_revision !=3D 0x0200 || + auth.hdr_cert_type !=3D WIN_CERT_TYPE_EFI_GUID || + !qemu_uuid_is_equal(&auth.guid_cert_type, &EfiCertTypePkcs7Guid)) { return EFI_UNSUPPORTED; } =20 @@ -255,7 +257,7 @@ efi_status uefi_vars_check_auth_2(uefi_vars_state *uv, = uefi_variable *var, } =20 /* checks passed, set variable data */ - var->time =3D auth->timestamp; + var->time =3D auth.timestamp; if (va->data_size - data_offset > 0) { var->data =3D g_malloc(va->data_size - data_offset); memcpy(var->data, data + data_offset, va->data_size - data_offset); --=20 2.53.0