sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

UefiPayloadPkg/Hob: Integer Overflow in CreateHob()

Browse Source 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166

Fix integer overflow in various CreateHob instances.
Fixes: CVE-2022-36765

The CreateHob() function aligns the requested size to 8
performing the following operation:
```
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
```

No checks are performed to ensure this value doesn't
overflow, and could lead to CreateHob() returning a smaller
HOB than requested, which could lead to OOB HOB accesses.

Reported-by: Marc Beatove <mbeatove@google.com>
Cc: Guo Dong <guo.dong@intel.com>
Cc: Sean Rhodes <sean@starlabs.systems>
Cc: James Lu <james.lu@intel.com>
Reviewed-by: Gua Guo <gua.guo@intel.com>
Cc: John Mathew <john.mathews@intel.com>
Authored-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Gua Guo <gua.guo@intel.com>
This commit is contained in:
Gua Guo
2024-01-11 13:01:19 +08:00
committed by mergify[bot]
parent 9971b99461
commit 59f024c76e
3 changed files with 53 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
UefiPayloadPkg/UefiPayloadEntry/UniversalPayloadEntry.c
View File

@@ -111,10 +111,12 @@ AddNewHob (
}
NewHob.Header = CreateHob (Hob->Header->HobType, Hob->Header->HobLength);
if (NewHob.Header != NULL) {
CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - sizeof (EFI_HOB_GENERIC_HEADER));
ASSERT (NewHob.Header != NULL);
if (NewHob.Header == NULL) {
return;
}
CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - sizeof (EFI_HOB_GENERIC_HEADER));
}
/**