From nobody Mon May 25 20:32:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778234178; cv=none; d=zohomail.com; s=zohoarc; b=XEjcrczrVEexV2l7/HEUYUuTRtPDy3Ai9kFm85adO2BoEqGQtr+y5/0E+OL4ibQL4GiEIWqOQrXqjaVQA5JWhiYLp3Xms19621aqw7MHpnj8T2QBsF4iJp22RwcXkc3ql86qGemLM6z0aochf1nVdsUTyrMyKUrzie+Q0MQuaFE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778234178; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=dPkaRT4X+fLUEURn7VrXYlL3lGvfZx54Iad0s4LXUto=; b=VV53Uo7v8ToQMPfS9m0IKv2X7499MTULimagIwof/JC3fbxxK7JCwNNB87GfPYIp6EGf+MG/kXw7jxvlTFgVZQSsHmBtiazYY+NAkyGsmylmpURha9TpsXPkjCeKsKFykOsVMYE2ABL2XSGy6ZuSnFEqAdHvYDT02zeGBxQTL9o= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778234178543964.7399530017128; Fri, 8 May 2026 02:56:18 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wLHvp-0007F4-AV; Fri, 08 May 2026 05:55:41 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvm-0007DF-SR for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:38 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvl-0000cM-76 for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:38 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-221-vZSOVuQnPImWgOEU71Xsyw-1; Fri, 08 May 2026 05:55:34 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1F8A1195608B; Fri, 8 May 2026 09:55:33 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.50.155]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 925F618004A3; Fri, 8 May 2026 09:55:32 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 8B02E1800846; Fri, 08 May 2026 11:55:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778234135; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dPkaRT4X+fLUEURn7VrXYlL3lGvfZx54Iad0s4LXUto=; b=L7/LhwyXRPZnvWYWqSxt43lFDktXSx15fOXGwoQS8Mnspy0dNw9pOcnAh9DmyC+qRuFvN7 1A6UxGR8ZaoY55TMN0YKZC0XpQpt0RBHdWAb7crG5KZvqrKZqW0ybwHm0/SilxkbPvJngH k9J3gj/LU0dxqD5XqTP73Bz31GbOJzI= X-MC-Unique: vZSOVuQnPImWgOEU71Xsyw-1 X-Mimecast-MFC-AGG-ID: vZSOVuQnPImWgOEU71Xsyw_1778234133 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PULL 1/6] hw/uefi: fix buffer overruns Date: Fri, 8 May 2026 11:55:26 +0200 Message-ID: <20260508095531.570979-2-kraxel@redhat.com> In-Reply-To: <20260508095531.570979-1-kraxel@redhat.com> References: <20260508095531.570979-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.438, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778234180671158500 Content-Type: text/plain; charset="utf-8" The buffer size checks do not consider the mm_header size, simliar to CVE-2026-5744. Factor out the repeated size check to a small helper function, fix the check, update all places to use the new helper. Fixes: CVE-2026-41435 Fixes: db1ecfb473ac ("hw/uefi: add var-service-vars.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann Message-ID: <20260422092910.444997-2-kraxel@redhat.com> --- hw/uefi/var-service-vars.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c index 5e3907118d4b..24e6516a9cc0 100644 --- a/hw/uefi/var-service-vars.c +++ b/hw/uefi/var-service-vars.c @@ -297,6 +297,17 @@ static size_t uefi_vars_mm_error(mm_header *mhdr, mm_v= ariable *mvar, return sizeof(*mvar); } =20 +static bool check_buffer_size(uefi_vars_state *uv, uint64_t length) +{ + /* uefi_vars_cmd_mm() checks that */ + g_assert(uv->buf_size >=3D sizeof(mm_header)); + + if (uv->buf_size - sizeof(mm_header) < length) { + return false; + } + return true; +} + static size_t uefi_vars_mm_get_variable(uefi_vars_state *uv, mm_header *mh= dr, mm_variable *mvar, void *func) { @@ -344,7 +355,7 @@ static size_t uefi_vars_mm_get_variable(uefi_vars_state= *uv, mm_header *mhdr, if (uadd64_overflow(length, va->data_size, &length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 @@ -414,7 +425,7 @@ uefi_vars_mm_get_next_variable(uefi_vars_state *uv, mm_= header *mhdr, } =20 length =3D sizeof(*mvar) + sizeof(*nv) + var->name_size; - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 @@ -605,7 +616,7 @@ static size_t uefi_vars_mm_variable_info(uefi_vars_stat= e *uv, mm_header *mhdr, uint64_t length; =20 length =3D sizeof(*mvar) + sizeof(*vi); - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 @@ -626,7 +637,7 @@ uefi_vars_mm_get_payload_size(uefi_vars_state *uv, mm_h= eader *mhdr, uint64_t length; =20 length =3D sizeof(*mvar) + sizeof(*ps); - if (uv->buf_size < length) { + if (!check_buffer_size(uv, length)) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } =20 --=20 2.54.0 From nobody Mon May 25 20:32:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778234162; cv=none; d=zohomail.com; s=zohoarc; b=BkVwA4cheoMPAWUItb0O5jmiE3XQGToGvnKx32oJQYfo7nlFUMjtQyzFzbl153yes0HWtYrYVVhOtJttHQjZ8vwBcxpBtWTOQRgFW2MEw6YMffgmsa7lvCPKr7TlBEmkhh3gbOcFHrpgkYpZIKTeCjOi1vKlXAfCq40feWHSKRY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778234162; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=RuMP+s5/PD/1RiBFZyD2CYaXkf6BnTeUO91VXz7Titg=; b=QAsOjDtF/lX9gKk8UiXqDTgaN2+mkX1KDb6K47hmA/N/OZezOjJEB7dDFtwut5qgaKtimx3/jbu9HMHSZdfsilKT4T4PbgrK37A2nn5X9xFpLmKfm5zdFDbygdS09hkGwFJAFoaa+ZhWkyptTygAkOPDrSjPBL0CqxMppE4NM3U= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778234162610361.2989612708385; Fri, 8 May 2026 02:56:02 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wLHvn-0007Dj-UK; Fri, 08 May 2026 05:55:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvm-0007DG-Sw for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:38 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvl-0000cZ-HW for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:38 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-648-yxaoPxSzPGSfhhO7_AJjNg-1; Fri, 08 May 2026 05:55:35 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 42A9D18002C9; Fri, 8 May 2026 09:55:34 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.50.155]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 058E81800347; Fri, 8 May 2026 09:55:34 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 9A8B31800D45; Fri, 08 May 2026 11:55:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778234136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RuMP+s5/PD/1RiBFZyD2CYaXkf6BnTeUO91VXz7Titg=; b=J/kWSQDHgeekrB0lpAwTMCBK009G9pEwUXtPqKq/SSOSuqkMEEaaVAWUqz8nJd5z24ZrlL 0Ni5hqsjswCwGANZjrSjSiwFuGtx8eyEMBgidpfTUkGM5mqDIFNzU9XkdVU3sLh5p9+XC3 /Z5ItUbw61CoJg/OhFvk2B3h56QntUc= X-MC-Unique: yxaoPxSzPGSfhhO7_AJjNg-1 X-Mimecast-MFC-AGG-ID: yxaoPxSzPGSfhhO7_AJjNg_1778234134 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PULL 2/6] hw/uefi: verify pio_xfer_offset before calculating buffer checksum Date: Fri, 8 May 2026 11:55:27 +0200 Message-ID: <20260508095531.570979-3-kraxel@redhat.com> In-Reply-To: <20260508095531.570979-1-kraxel@redhat.com> References: <20260508095531.570979-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.438, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778234166889154100 Content-Type: text/plain; charset="utf-8" Without that it is possible to do trigger OOB reads by first advancing offset, then making the buffer smaller, finally asking for a checksum. Fixes: CVE-2026-41436 Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann Message-ID: <20260422092910.444997-3-kraxel@redhat.com> --- hw/uefi/var-service-core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/uefi/var-service-core.c b/hw/uefi/var-service-core.c index 68d7594c0dd6..828d76007318 100644 --- a/hw/uefi/var-service-core.c +++ b/hw/uefi/var-service-core.c @@ -235,6 +235,10 @@ static uint64_t uefi_vars_read(void *opaque, hwaddr ad= dr, unsigned size) uv->pio_xfer_offset +=3D size; break; case UEFI_VARS_REG_PIO_BUFFER_CRC32C: + if (uv->pio_xfer_offset > uv->buf_size) { + retval =3D 0; + break; + } retval =3D crc32c(0xffffffff, uv->pio_xfer_buffer, uv->pio_xfer_of= fset); break; case UEFI_VARS_REG_FLAGS: --=20 2.54.0 From nobody Mon May 25 20:32:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778234152; cv=none; d=zohomail.com; s=zohoarc; b=DOReX8zxQynPIrF2x96N5N6AVBhttncxUgbBWAsa94haK2v3QrhqIM2iH3bCpkXGGFxy6A5ZgcLftm0IZ0CSr0E37IMdwkydRHzi4XTimSPCRMQIPcGQOn6k5vYk2qrssxM7cjLQn1jX2gP4HOuggzg7anMVvuNZbLnAbFfEozs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778234152; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=cGJ5THQYtgZPxxVQ4uI5u9kDWc8cMjKeF9r+LCS3Dz0=; b=hshlEI01kJl/lASVk04T7hbWP3wKvm2QvsQrkBZE1K2tKwPrMlfM+jzLlbsKt+KLM97mDEE90HkyuWGIQnuaaVOfvy9wnLAKWNz5ELv6LOZC58hJoJdsy5ijp08ChdqkbjZuCZ3sk8/Swwa4NvFrEQpKjbjLMv8cpQmMWxR5dC0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778234152338333.4189210547157; Fri, 8 May 2026 02:55:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wLHvp-0007FK-Su; Fri, 08 May 2026 05:55:42 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvo-0007Do-CW for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:40 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvl-0000cY-JZ for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:40 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-662-EYpa2dRYP2mR1-bgGrPh7A-1; Fri, 08 May 2026 05:55:35 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 5FC4C180034E; Fri, 8 May 2026 09:55:34 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.50.155]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 02852300019F; Fri, 8 May 2026 09:55:34 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id A99761800D46; Fri, 08 May 2026 11:55:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778234136; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=cGJ5THQYtgZPxxVQ4uI5u9kDWc8cMjKeF9r+LCS3Dz0=; b=ejuYgcDdKnnMi2cGEd+xjC4jElU5L3LcNU6U/MrQp8MiAD8Me45zQfrIPdXIDmm2eJtsG+ weceMR1x6E0JPa9deTvnM1HZrEVslmbzv9Qr30qgNPE8fbthc4TNkRnzpbJR4eysAM+WVk I3DFR3Rr8e0ddpKvtOHHk2qblAPNYlU= X-MC-Unique: EYpa2dRYP2mR1-bgGrPh7A-1 X-Mimecast-MFC-AGG-ID: EYpa2dRYP2mR1-bgGrPh7A_1778234134 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PULL 3/6] hw/uefi: fix ucs2 string helper functions Date: Fri, 8 May 2026 11:55:28 +0200 Message-ID: <20260508095531.570979-4-kraxel@redhat.com> In-Reply-To: <20260508095531.570979-1-kraxel@redhat.com> References: <20260508095531.570979-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.438, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778234155080158500 Content-Type: text/plain; charset="utf-8" The length passed in is in bytes not characters. Rename the parameters to make that clear. Calculate the number of chars if needed. Fix length checks to use the number of chars not bytes to avoid OOB reads. Fixes: CVE-2026-41437 Fixes: 1ebc319c8ca7 ("hw/uefi: add var-service-utils.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann Message-ID: <20260422092910.444997-4-kraxel@redhat.com> --- hw/uefi/var-service-utils.c | 42 +++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 18 deletions(-) diff --git a/hw/uefi/var-service-utils.c b/hw/uefi/var-service-utils.c index 258013f436af..489321a26ccb 100644 --- a/hw/uefi/var-service-utils.c +++ b/hw/uefi/var-service-utils.c @@ -19,13 +19,18 @@ * sometimes when they are not (for example in variable policies). */ =20 -gboolean uefi_str_is_valid(const uint16_t *str, size_t len, +gboolean uefi_str_is_valid(const uint16_t *str, size_t bytes, gboolean must_be_null_terminated) { + size_t chars =3D bytes / 2; size_t pos =3D 0; =20 + if ((bytes % 2) !=3D 0) { + return false; + } + for (;;) { - if (pos =3D=3D len) { + if (pos =3D=3D chars) { if (must_be_null_terminated) { return false; } else { @@ -47,12 +52,13 @@ gboolean uefi_str_is_valid(const uint16_t *str, size_t = len, } } =20 -size_t uefi_strlen(const uint16_t *str, size_t len) +size_t uefi_strlen(const uint16_t *str, size_t bytes) { + size_t chars =3D bytes / 2; size_t pos =3D 0; =20 for (;;) { - if (pos =3D=3D len) { + if (pos =3D=3D chars) { return pos; } if (str[pos] =3D=3D 0) { @@ -62,25 +68,25 @@ size_t uefi_strlen(const uint16_t *str, size_t len) } } =20 -gboolean uefi_str_equal_ex(const uint16_t *a, size_t alen, - const uint16_t *b, size_t blen, +gboolean uefi_str_equal_ex(const uint16_t *a, size_t a_bytes, + const uint16_t *b, size_t b_bytes, gboolean wildcards_in_a) { + size_t a_chars =3D a_bytes / 2; + size_t b_chars =3D b_bytes / 2; size_t pos =3D 0; =20 - alen =3D alen / 2; - blen =3D blen / 2; for (;;) { - if (pos =3D=3D alen && pos =3D=3D blen) { + if (pos =3D=3D a_chars && pos =3D=3D b_chars) { return true; } - if (pos =3D=3D alen && b[pos] =3D=3D 0) { + if (pos =3D=3D a_chars && b[pos] =3D=3D 0) { return true; } - if (pos =3D=3D blen && a[pos] =3D=3D 0) { + if (pos =3D=3D b_chars && a[pos] =3D=3D 0) { return true; } - if (pos =3D=3D alen || pos =3D=3D blen) { + if (pos =3D=3D a_chars || pos =3D=3D b_chars) { return false; } if (a[pos] =3D=3D 0 && b[pos] =3D=3D 0) { @@ -100,18 +106,18 @@ gboolean uefi_str_equal_ex(const uint16_t *a, size_t = alen, } } =20 -gboolean uefi_str_equal(const uint16_t *a, size_t alen, - const uint16_t *b, size_t blen) +gboolean uefi_str_equal(const uint16_t *a, size_t a_bytes, + const uint16_t *b, size_t b_bytes) { - return uefi_str_equal_ex(a, alen, b, blen, false); + return uefi_str_equal_ex(a, a_bytes, b, b_bytes, false); } =20 -char *uefi_ucs2_to_ascii(const uint16_t *ucs2, uint64_t ucs2_size) +char *uefi_ucs2_to_ascii(const uint16_t *ucs2, uint64_t ucs2_bytes) { - char *str =3D g_malloc0(ucs2_size / 2 + 1); + char *str =3D g_malloc0(ucs2_bytes / 2 + 1); int i; =20 - for (i =3D 0; i * 2 < ucs2_size; i++) { + for (i =3D 0; i * 2 < ucs2_bytes; i++) { if (ucs2[i] =3D=3D 0) { break; } --=20 2.54.0 From nobody Mon May 25 20:32:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778234157; cv=none; d=zohomail.com; s=zohoarc; b=NwXjn+2AXSaYqjYTI+PctHdAGodzSOUO5eFawhoOniLn2U9ezFwLPqK4rle3GxCcd+o7S8CQ25JwDIX4HwsYw/5/VZB3IwrMFDUEZs+xde6uKgEJvnFERfvjDdcbBLTQPSh9ydW3z5t+w5b6U0kcZtIps7aiDY/7EUC8oMeWya0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778234157; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=FgmeX5jHLkDK3WGFiB++OFN+ffD3IhKwX0CPlF5Jj8U=; b=Of+tWU0MtR625eFF7ZLGN+F8MIXsD4IO09lUs37ZhW051k1mkZGGwblD5vr3Ua+HDFUk4cYIeERULwYNIiQdnPOUhqmFvIV+jve/pSajvWtDe6z1hJNuNpsN8Cf9hxLngw3tSZwYO6p8PS2d9J6UoaKOEBV0BVDjB8pcgIEGvDU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 177823415791064.48096024818233; Fri, 8 May 2026 02:55:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wLHvz-0007HL-CP; Fri, 08 May 2026 05:55:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvo-0007Dk-24 for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:40 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvm-0000cn-25 for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:39 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-107-7bZYLvnsNtiVCaMrJowWVQ-1; Fri, 08 May 2026 05:55:35 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 19FF918002CF; Fri, 8 May 2026 09:55:35 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.50.155]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id CEE393002D2F; Fri, 8 May 2026 09:55:34 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id B81CE1800D48; Fri, 08 May 2026 11:55:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778234137; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FgmeX5jHLkDK3WGFiB++OFN+ffD3IhKwX0CPlF5Jj8U=; b=U9Rcu3fmVZ8NimUmOOmrYNxSoCs0RGqWgJctd/8k+LBbgwYoeK+URZKYGQZE6pYytKq39d iJqf2mRuQPZCtH6bGhfD8zFn2xQzGh4VbmGltRrK1ppzt4666eCwsQUt4kVNOGWZezyGo1 K2ZVkrLybm8pdsBA5pm+NmbXFIRrKwQ= X-MC-Unique: 7bZYLvnsNtiVCaMrJowWVQ-1 X-Mimecast-MFC-AGG-ID: 7bZYLvnsNtiVCaMrJowWVQ_1778234135 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PULL 4/6] hw/uefi: add name_size check to uefi_vars_mm_lock_variable() Date: Fri, 8 May 2026 11:55:29 +0200 Message-ID: <20260508095531.570979-5-kraxel@redhat.com> In-Reply-To: <20260508095531.570979-1-kraxel@redhat.com> References: <20260508095531.570979-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.438, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778234159827154100 Content-Type: text/plain; charset="utf-8" Make sure the total variable_policy_entry size stays below 64k so the (16-bit) size field can not wrap. Fixes: CVE-2026-41438 Fixes: db1ecfb473ac ("hw/uefi: add var-service-vars.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann Message-ID: <20260422092910.444997-5-kraxel@redhat.com> --- hw/uefi/var-service-vars.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c index 24e6516a9cc0..2c83130ebf63 100644 --- a/hw/uefi/var-service-vars.c +++ b/hw/uefi/var-service-vars.c @@ -667,6 +667,9 @@ uefi_vars_mm_lock_variable(uefi_vars_state *uv, mm_head= er *mhdr, if (mhdr->length < length) { return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); } + if (sizeof(*pe) + lv->name_size > UINT16_MAX) { + return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE); + } =20 uefi_trace_variable(__func__, lv->guid, name, lv->name_size); =20 --=20 2.54.0 From nobody Mon May 25 20:32:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778234164; cv=none; d=zohomail.com; s=zohoarc; b=Ej48PYLvktb3SkEfodG0c3b1r2XjZsYLGybd4u1BA79zkS4u3R5U9UnHVnLsNnoEMiDQnZno8kHS3ysWUK/DEhqR/Dj8oW0dooa75tUPQjjhV3AbXNCZUd3OOdWgtsi/1/1sbJgsvYkxn/QlReBbUkIApFOTPictgXiQVZgxqZw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778234164; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=M3FkgRBiYzmZT7k+q8pE8tkNsvK5TREDhYRD6V3EQXU=; b=a+HvRcD7Jq9prZkle1JlNA+Hfvui7KmNoqH3KMDvsmGsJ59J8hi2/i1E2ITCZYSUf7Zw0Tmc3XA1SmO97Z7ZRUG4dDQfSqvpnRUdFD83lUHgtj6NejMm8D+5Z+KgkKYi3YPV3T1s5vbjqMT9ZTIg4o5eSTDfKc1yFB5CdvHbkfs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778234164975633.2827453124063; Fri, 8 May 2026 02:56:04 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wLHvx-0007Gn-UK; Fri, 08 May 2026 05:55:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvq-0007FV-Hw for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:42 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvp-0000dR-4v for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:42 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-139-MQ4ipFVIOOKtYh00Edi1pQ-1; Fri, 08 May 2026 05:55:36 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 4862618002CB; Fri, 8 May 2026 09:55:35 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.50.155]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id D2BA61800347; Fri, 8 May 2026 09:55:34 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id C67681800D51; Fri, 08 May 2026 11:55:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778234140; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=M3FkgRBiYzmZT7k+q8pE8tkNsvK5TREDhYRD6V3EQXU=; b=Z7hENdq8CMNE5JeJitRCNVy45b8gmzDOkKIm3bZyFu2R77+CZ+a2LN+E1TCgextBQ1Pcru EUAdg92CJP7z2ZQCafRlcSd92EK/C9L/Dzfu0LamUcxpL2HgveWiNh/ZcMtD5ZS0SKX0/h wPF/mtzfVwWHcncSFNzq+vbJKwzT7Fw= X-MC-Unique: MQ4ipFVIOOKtYh00Edi1pQ-1 X-Mimecast-MFC-AGG-ID: MQ4ipFVIOOKtYh00Edi1pQ_1778234135 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PULL 5/6] hw/uefi: verify data size before accessing it in wrap_pkcs7 Date: Fri, 8 May 2026 11:55:30 +0200 Message-ID: <20260508095531.570979-6-kraxel@redhat.com> In-Reply-To: <20260508095531.570979-1-kraxel@redhat.com> References: <20260508095531.570979-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.438, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778234167060154100 Content-Type: text/plain; charset="utf-8" Fixes: CVE-2026-41439 Fixes: 3e33af2cb306 ("hw/uefi: add var-service-pkcs7.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann Message-ID: <20260422092910.444997-6-kraxel@redhat.com> --- hw/uefi/var-service-pkcs7.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/uefi/var-service-pkcs7.c b/hw/uefi/var-service-pkcs7.c index 32accf4e44e0..f17ad6872fd2 100644 --- a/hw/uefi/var-service-pkcs7.c +++ b/hw/uefi/var-service-pkcs7.c @@ -73,7 +73,8 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7) }; gnutls_datum_t wrap; =20 - if (pkcs7->data[4] =3D=3D 0x06 && + if (pkcs7->size > 16 && + pkcs7->data[4] =3D=3D 0x06 && pkcs7->data[5] =3D=3D 0x09 && memcmp(pkcs7->data + 6, signed_data_oid, sizeof(signed_data_oid)) = =3D=3D 0 && pkcs7->data[15] =3D=3D 0x0a && --=20 2.54.0 From nobody Mon May 25 20:32:02 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1778234206; cv=none; d=zohomail.com; s=zohoarc; b=j/knBDdwBh9Z9fiYUd67QJg2MkLjmKsCD+uoGQSmHIy2YQxXbbF677IOKu/W28VhoZfajR10j6w18AgVkZtBA2QtawSoAwZAKaJ1TZvgfVXH1I9hxVmtJFMxISdfAU3LBhI/k7rMAw5qnCeKuz3tuC3Gaz6VJ0dg9eUrivTWnJ4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1778234206; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NXPgRyhka1iUgbT+spcMP/7bRVi6wwqH8SQF2ppJD+E=; b=EAVlZ3V68QLPAzYsDONofRCYtd5Iwwypxr22NxVlKEyx7ObijKtgZV/lNVkuIjhpylj4GSZzVCRgvtEhx0Co8XyeL1+nZJYD6RU64SIRS+y2kV42hPnxxYnZvffOSfoBkgMOsp3xV99xGFnond8GZIQNlsqjcNCs+xa7bZovOs4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1778234206484713.2287008860458; Fri, 8 May 2026 02:56:46 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wLHvy-0007HE-EW; Fri, 08 May 2026 05:55:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvs-0007Fp-Da for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:44 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wLHvp-0000dT-9M for qemu-devel@nongnu.org; Fri, 08 May 2026 05:55:42 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-357-DYHtpAk8PaqU_eJ6Vfo_ZA-1; Fri, 08 May 2026 05:55:36 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C16D11956062; Fri, 8 May 2026 09:55:35 +0000 (UTC) Received: from sirius.home.kraxel.org (unknown [10.44.50.155]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 81C59300019F; Fri, 8 May 2026 09:55:35 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id D80541800D52; Fri, 08 May 2026 11:55:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1778234140; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NXPgRyhka1iUgbT+spcMP/7bRVi6wwqH8SQF2ppJD+E=; b=U+1H5vbORdQj/xewxIuAhNUrBVpYgPOEJxehyADTapSmZ7bFbcE4h+HPVNb4oD36dZqsZ9 2YYgao+VBp6PthjR09aMs5hagHaH/Gog5MX6UkPDGsHl6brwxw5ITBqHgHFg58Sx7eBJG8 BCAhNPcbkFmn7yDcGbmU1WTeuqfa1YI= X-MC-Unique: DYHtpAk8PaqU_eJ6Vfo_ZA-1 X-Mimecast-MFC-AGG-ID: DYHtpAk8PaqU_eJ6Vfo_ZA_1778234135 From: Gerd Hoffmann To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , Katherine Leaver Subject: [PULL 6/6] hw/uefi: avoid possibly unaligned variable_auth_2 struct field access Date: Fri, 8 May 2026 11:55:31 +0200 Message-ID: <20260508095531.570979-7-kraxel@redhat.com> In-Reply-To: <20260508095531.570979-1-kraxel@redhat.com> References: <20260508095531.570979-1-kraxel@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=kraxel@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.438, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1778234208863158500 Content-Type: text/plain; charset="utf-8" Copy data to stack-allocated struct before accessing it to make sure it is properly aligned. Fixes: CVE-2026-41440 Fixes: f1488fac0584 ("hw/uefi: add var-service-auth.c") Reported-by: Katherine Leaver Signed-off-by: Gerd Hoffmann Message-ID: <20260422092910.444997-7-kraxel@redhat.com> --- hw/uefi/var-service-auth.c | 21 ++++++++++++--------- hw/uefi/var-service-pkcs7.c | 18 +++++++++++------- 2 files changed, 23 insertions(+), 16 deletions(-) diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c index fba5a0956a57..795f2f54e4ab 100644 --- a/hw/uefi/var-service-auth.c +++ b/hw/uefi/var-service-auth.c @@ -180,9 +180,10 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars_= state *uv, void *data, uint64_t data_offset) { - variable_auth_2 *auth =3D data; + variable_auth_2 auth; uefi_variable *siglist; =20 + memcpy(&auth, data, sizeof(auth)); if (custom_mode_is_active(uv)) { /* no authentication in custom mode */ return EFI_SUCCESS; @@ -193,7 +194,7 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars_s= tate *uv, return EFI_SUCCESS; } =20 - if (auth->hdr_length =3D=3D 24) { + if (auth.hdr_length =3D=3D 24) { /* no signature (auth->cert_data is empty) */ return EFI_SECURITY_VIOLATION; } @@ -218,23 +219,25 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars= _state *uv, efi_status uefi_vars_check_auth_2(uefi_vars_state *uv, uefi_variable *var, mm_variable_access *va, void *data) { - variable_auth_2 *auth =3D data; + variable_auth_2 auth; uint64_t data_offset; efi_status status; =20 - if (va->data_size < sizeof(*auth)) { + if (va->data_size < sizeof(auth)) { return EFI_SECURITY_VIOLATION; } - if (uadd64_overflow(sizeof(efi_time), auth->hdr_length, &data_offset))= { + memcpy(&auth, data, sizeof(auth)); + + if (uadd64_overflow(sizeof(efi_time), auth.hdr_length, &data_offset)) { return EFI_SECURITY_VIOLATION; } if (va->data_size < data_offset) { return EFI_SECURITY_VIOLATION; } =20 - if (auth->hdr_revision !=3D 0x0200 || - auth->hdr_cert_type !=3D WIN_CERT_TYPE_EFI_GUID || - !qemu_uuid_is_equal(&auth->guid_cert_type, &EfiCertTypePkcs7Guid))= { + if (auth.hdr_revision !=3D 0x0200 || + auth.hdr_cert_type !=3D WIN_CERT_TYPE_EFI_GUID || + !qemu_uuid_is_equal(&auth.guid_cert_type, &EfiCertTypePkcs7Guid)) { return EFI_UNSUPPORTED; } =20 @@ -255,7 +258,7 @@ efi_status uefi_vars_check_auth_2(uefi_vars_state *uv, = uefi_variable *var, } =20 /* checks passed, set variable data */ - var->time =3D auth->timestamp; + var->time =3D auth.timestamp; if (va->data_size - data_offset > 0) { var->data =3D g_malloc(va->data_size - data_offset); memcpy(var->data, data + data_offset, va->data_size - data_offset); diff --git a/hw/uefi/var-service-pkcs7.c b/hw/uefi/var-service-pkcs7.c index f17ad6872fd2..c859743e8677 100644 --- a/hw/uefi/var-service-pkcs7.c +++ b/hw/uefi/var-service-pkcs7.c @@ -21,17 +21,20 @@ */ static gnutls_datum_t *build_signed_data(mm_variable_access *va, void *dat= a) { - variable_auth_2 *auth =3D data; - uint64_t data_offset =3D sizeof(efi_time) + auth->hdr_length; + variable_auth_2 auth; + uint64_t data_offset; uint16_t *name =3D (void *)va + sizeof(mm_variable_access); gnutls_datum_t *sdata; uint64_t pos =3D 0; =20 + memcpy(&auth, data, sizeof(auth)); + data_offset =3D sizeof(efi_time) + auth.hdr_length; + sdata =3D g_new(gnutls_datum_t, 1); sdata->size =3D (va->name_size - 2 + sizeof(QemuUUID) + sizeof(va->attributes) - + sizeof(auth->timestamp) + + sizeof(auth.timestamp) + va->data_size - data_offset); sdata->data =3D g_malloc(sdata->size); =20 @@ -48,8 +51,8 @@ static gnutls_datum_t *build_signed_data(mm_variable_acce= ss *va, void *data) pos +=3D sizeof(va->attributes); =20 /* TimeStamp */ - memcpy(sdata->data + pos, &auth->timestamp, sizeof(auth->timestamp)); - pos +=3D sizeof(auth->timestamp); + memcpy(sdata->data + pos, &auth.timestamp, sizeof(auth.timestamp)); + pos +=3D sizeof(auth.timestamp); =20 /* Variable Content */ memcpy(sdata->data + pos, data + data_offset, va->data_size - data_off= set); @@ -105,11 +108,12 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7) =20 static gnutls_datum_t *build_pkcs7(void *data) { - variable_auth_2 *auth =3D data; + variable_auth_2 auth; gnutls_datum_t *pkcs7; =20 + memcpy(&auth, data, sizeof(auth)); pkcs7 =3D g_new(gnutls_datum_t, 1); - pkcs7->size =3D auth->hdr_length - 24; + pkcs7->size =3D auth.hdr_length - 24; pkcs7->data =3D g_malloc(pkcs7->size); memcpy(pkcs7->data, data + 16 + 24, pkcs7->size); =20 --=20 2.54.0