diff --git a/SecurityPkg/VariableAuthenticated/Pei/Variable.c b/SecurityPkg/VariableAuthenticated/Pei/Variable.c index 7549be2dca..d27f679073 100644 --- a/SecurityPkg/VariableAuthenticated/Pei/Variable.c +++ b/SecurityPkg/VariableAuthenticated/Pei/Variable.c @@ -359,6 +359,15 @@ GetVariableStore ( PcdGet64 (PcdFlashNvStorageVariableBase64) : PcdGet32 (PcdFlashNvStorageVariableBase) ); + + // + // Check if the Firmware Volume is not corrupted + // + if ((FvHeader->Signature != EFI_FVH_SIGNATURE) || (!CompareGuid (&gEfiSystemNvDataFvGuid, &FvHeader->FileSystemGuid))) { + DEBUG ((EFI_D_ERROR, "Firmware Volume for Variable Store is corrupted\n")); + break; + } + VariableStoreHeader = (VARIABLE_STORE_HEADER *) ((UINT8 *) FvHeader + FvHeader->HeaderLength); if (IndexTable != NULL) { diff --git a/SecurityPkg/VariableAuthenticated/Pei/Variable.h b/SecurityPkg/VariableAuthenticated/Pei/Variable.h index 75d32dac5f..a85d3bbab6 100644 --- a/SecurityPkg/VariableAuthenticated/Pei/Variable.h +++ b/SecurityPkg/VariableAuthenticated/Pei/Variable.h @@ -29,6 +29,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #include #include +#include typedef enum { VariableStoreTypeHob, diff --git a/SecurityPkg/VariableAuthenticated/Pei/VariablePei.inf b/SecurityPkg/VariableAuthenticated/Pei/VariablePei.inf index 7863293ff8..e74143cd19 100644 --- a/SecurityPkg/VariableAuthenticated/Pei/VariablePei.inf +++ b/SecurityPkg/VariableAuthenticated/Pei/VariablePei.inf @@ -46,6 +46,7 @@ [Guids] gEfiAuthenticatedVariableGuid gEfiVariableIndexTableGuid + gEfiSystemNvDataFvGuid [Ppis] gEfiPeiReadOnlyVariable2PpiGuid ## SOMETIMES_PRODUCES (Not for boot mode RECOVERY) diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c index 7d0d21502a..e3fc48b497 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c @@ -1157,7 +1157,7 @@ VariableGetBestLanguage ( **/ VOID -AutoUpdateLangVariable( +AutoUpdateLangVariable ( IN CHAR16 *VariableName, IN VOID *Data, IN UINTN DataSize @@ -2616,6 +2616,17 @@ VariableCommonInitialize ( if (TempVariableStoreHeader == 0) { TempVariableStoreHeader = (EFI_PHYSICAL_ADDRESS) PcdGet32 (PcdFlashNvStorageVariableBase); } + + // + // Check if the Firmware Volume is not corrupted + // + if ((((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)(TempVariableStoreHeader))->Signature != EFI_FVH_SIGNATURE) || + (!CompareGuid (&gEfiSystemNvDataFvGuid, &((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)(TempVariableStoreHeader))->FileSystemGuid))) { + Status = EFI_VOLUME_CORRUPTED; + DEBUG ((EFI_D_ERROR, "Firmware Volume for Variable Store is corrupted\n")); + goto Done; + } + VariableStoreBase = TempVariableStoreHeader + \ (((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)(TempVariableStoreHeader)) -> HeaderLength); VariableStoreLength = (UINT64) PcdGet32 (PcdFlashNvStorageVariableSize) - \ diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h index 91c7b4aac0..58d1e5a8cd 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h @@ -39,6 +39,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #include #include #include +#include #define VARIABLE_RECLAIM_THRESHOLD (1024) diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf index 7fcb640de0..70717c4573 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf @@ -73,6 +73,7 @@ gEfiCertPkcs7Guid gEfiCertRsa2048Guid gEfiSecureBootEnableDisableGuid + gEfiSystemNvDataFvGuid ## CONSUMES [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf index 628c9829fd..84762dc406 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf @@ -78,6 +78,7 @@ gEfiCertPkcs7Guid gEfiCertRsa2048Guid gEfiSecureBootEnableDisableGuid + gEfiSystemNvDataFvGuid ## CONSUMES [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize