diff options
| author | Gua Guo <gua.guo@intel.com> | 2024-01-11 13:01:19 +0800 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2024-01-16 23:36:08 +0000 |
| commit | 59f024c76ee57c2bec84794536302fc770cd6ec2 (patch) | |
| tree | 170c7b9239303e7aad9cd5699bf4358cd8b04eea /UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c | |
| parent | 9971b99461e930008e3d35bc0a4a310b6afa57f6 (diff) | |
| download | edk2-59f024c76ee57c2bec84794536302fc770cd6ec2.tar.gz edk2-59f024c76ee57c2bec84794536302fc770cd6ec2.tar.bz2 edk2-59f024c76ee57c2bec84794536302fc770cd6ec2.zip | |
UefiPayloadPkg/Hob: Integer Overflow in CreateHob()
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
Fix integer overflow in various CreateHob instances.
Fixes: CVE-2022-36765
The CreateHob() function aligns the requested size to 8
performing the following operation:
```
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
```
No checks are performed to ensure this value doesn't
overflow, and could lead to CreateHob() returning a smaller
HOB than requested, which could lead to OOB HOB accesses.
Reported-by: Marc Beatove <mbeatove@google.com>
Cc: Guo Dong <guo.dong@intel.com>
Cc: Sean Rhodes <sean@starlabs.systems>
Cc: James Lu <james.lu@intel.com>
Reviewed-by: Gua Guo <gua.guo@intel.com>
Cc: John Mathew <john.mathews@intel.com>
Authored-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Gua Guo <gua.guo@intel.com>
Diffstat (limited to 'UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c')
| -rw-r--r-- | UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c b/UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c index d2e7df4fbe..eb0b325369 100644 --- a/UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c +++ b/UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c @@ -207,10 +207,12 @@ AddNewHob ( }
NewHob.Header = CreateHob (Hob->Header->HobType, Hob->Header->HobLength);
-
- if (NewHob.Header != NULL) {
- CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - sizeof (EFI_HOB_GENERIC_HEADER));
+ ASSERT (NewHob.Header != NULL);
+ if (NewHob.Header == NULL) {
+ return;
}
+
+ CopyMem (NewHob.Header + 1, Hob->Header + 1, Hob->Header->HobLength - sizeof (EFI_HOB_GENERIC_HEADER));
}
/**
|