summaryrefslogtreecommitdiffstats
path: root/NetworkPkg
Commit message (Collapse)AuthorAgeFilesLines
* Remove all ArmSoftFloatLib library class resolutionsArd Biesheuvel7 days1-3/+0
| | | | | | | ArmSoftFloatLib is going away, so remove all residual references to it. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
* NetworkPkg: Restore TPL Before ReturnOliver Smith-Denny11 days3-5/+6
| | | | | | | | This patch fixes a few instances of error cases in NetworkPkg returning after a RaiseTPL call without restoring the TPL first. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* NetworkPkg/DxeNetLib: make mSecureHashAlgorithms staticGerd Hoffmann2024-11-141-1/+1
| | | | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* MdePkg: MdeLibs.dsc.inc: Apply StackCheckLibNull to All Module TypesOliver Smith-Denny2024-11-131-4/+0
| | | | | | | | | | | | | | | Now that the ResetVectors are USER_DEFINED modules, they will not be linked against StackCheckLibNull, which were the only modules causing issues. So, we can now remove the kludge we had before and the requirement for every DSC to include StackCheckLibNull for SEC modules and just apply StackCheckLibNull globally. This also changes every DSC to drop the SEC definition of StackCheckLibNull. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* NetworkPkg: mark fixed network PCDsAleksandr Goncharov2024-11-112-4/+4
| | | | | | | | | | Rename `NetworkPcds` to `NetworkFixedPcds` to avoid confusion with dynamic PCDs. The next patches in the chain will update all references across the codebase to use the new name. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Aleksandr Goncharov <chat@joursoir.net>
* NetworkPkg: introduce include file for dynamic PCDsAleksandr Goncharov2024-11-112-0/+23
| | | | | | | | | | | | | | Introduce an include file with dynamic PCDs to simplify the usage of the network stage. This allows us to stop manually adding `PcdIPv4PXESupport` and `PcdIPv6PXESupport` to the DSC file. `NETWORK_IP4_ENABLE` and `NETWORK_IP6_ENABLE` are not used because PXEv4 and PXEv6 boot support can be controlled from the QEMU command line. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Aleksandr Goncharov <chat@joursoir.net>
* NetworkPkg/Dhcp6Dxe: Fix sanitizer issuesMichael D Kinney2024-11-111-3/+3
| | | | | | | | | | | | | | * EFI_DHCP6_DUID structure declares Duid[1], so the size of that structure is not large enough to hold an entire Duid. Instead, compute the correct size to allocate an EFI_DHCP6_DUID structure. * Dhcp6AppendOption() takes a length parameter that in network order. Update test cases to make sure a network order length is passed in. A value of 0x0004 was being passed in and was then converted to 0x0400 length and buffer overflow was detected. Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
* NetworkPkg/HttpBootDxe: Report download error when resume attempts failLeandro Becker2024-10-151-1/+2
| | | | | | | | | | When all resume attempts to continue an interrupted NBP file download have failed, report the failure status to the caller. Original implementation was returning success when number of retries reaches the limit defined by PcdMaxHttpResumeRetries. Signed-off-by: Leandro Gustavo Biss Becker <lbecker@positivo.com.br>
* NetworkPkg/Dhcp6Dxe: Fix extraneous parenthesessecurity-advisory/cve-2024-38796/advisoryMike Beaton2024-09-271-1/+1
| | | | | | | | | | Without this change we get: error: equality comparison with extraneous parentheses when building with -D NETWORK_IP6_ENABLE on XCODE5. Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* NetworkPkg/HttpBootDxe: Correctly uninstall HttpBootCallbackProtocolMike Beaton2024-09-151-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The existing HttpBootUninstallCallback was passing the wrong handle (the PrivateData root controller handle, not the correct child IPv4 or IPv6 NIC controller handle; cf HttpBootInstallCallback for matching logic) and was also passing the address of a pointer to the interface to be removed rather than the pointer itself, so always failed with EFI_NOT_FOUND. This resulted in the prior behaviour that if multiple HTTP boot attempts were made, on the second and subsequent attempts the instance of this protocol installed by the first attempt would be re-used. As long as only one driver using the protocol is installed, this ends up producing the same results as if the protocol had been uninstalled then reinstalled correctly. After this commit, the protocol is installed at the start of an HTTP boot attempt and uninstalled it at the end of it (assuming nothing else has accessed the protocol in a way which blocks the uninstall). It might seem attractive to add an ASSERT to confirm when debugging that the uninstall succeeds as expected, but this is recommended against because uninstallation of protocol interfaces is allowed to fail under the UEFI model: https://edk2.groups.io/g/devel/message/117469. An ASSERT could therefore arise from a sequence of events which is perfectly valid - or at least is out of the control of this driver. Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* MdePkg: Move PcdEnforceSecureRngAlgorithms from NetworkPkgPierre Gondois2024-09-132-7/+1
| | | | | | | | | | The PcdEnforceSecureRngAlgorithms Pcd enforces the use of RNG algorithms defined by the UEFI spec. To re-use the Pcd in other packages and have a generic mean to control the usage of unsecure algorithms, move the Pcd to the MdePkg. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
* NetworkPkg/HttpBootDxe: Resume an interrupted boot file download.Leandro Becker2024-09-136-22/+252
| | | | | | | | When the boot file download operation is interrupted for some reason, HttpBootDxe will use HTTP Range header to try resume the download operation reusing the bytes downloaded so far. Signed-off-by: Leandro Gustavo Biss Becker <lbecker@positivo.com.br>
* NetworkPkg: Add StackCheckLibTaylor Beebe2024-09-132-4/+4
| | | | | | | Remove the old stack check lib now that MdeLibs.inc includes the new one. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* NetworkPkg: PxeBcDhcp6GoogleTest: Fix Stack Smashing Unit TestOliver Smith-Denny2024-09-131-8/+17
| | | | | | | | | | | | PxeBcDhcp6GoogleTest's MultipleDnsEntries test started to fail with stack cookies added for host applications. Debugging this showed that the test was attempting to copy two UINT16s to a UINT8 Data[1] array allocated on the stack. This was moved to a heap based allocation for a UINT32 to accommodate the proper size. After this fix, the unit test passed with stack cookies enabled. Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* NetworkPkg: Fix unable to build OVMF with -D NETWORK_ENABLE=0Mike Beaton2024-09-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://bugzilla.tianocore.org/show_bug.cgi?id=4829 7f17a15 (2024/02/22) "OvmfPkg: Shell*.inc: allow building without network support" breaks building OVMF with `-D NETWORK_ENABLE=0`. Before this commit we could build OVMF e.g. with the following command in the OvmfPkg directory: ./build.sh -D NETWORK_ENABLE=0 After the commit the same command fails early with: /home/user/OpenSource/edk2/OvmfPkg/OvmfPkgX64.dsc(15): error F001: Pcd (gEfiNetworkPkgTokenSpaceGuid.PcdAllowHttpConnections) defined in DSC is not declared in DEC files referenced in INF files in FDF. Arch: ['X64'] This commit conditionally removes the undefined Pcd reference in NetworkPkg which is part of this issue. Similar changes are needed in separate commits for OvmfPkg (and for ArmVirtPkg, since the issue also exists there, although masked by another issue). Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* MdePkg: Move CompilerIntrinsicsLib from ArmPkgOliver Smith-Denny2024-09-122-14/+4
| | | | | | | | | | | | | | | | | | | | As per the emailed RFC in https://edk2.groups.io/g/devel/topic/rfc_move/107675828, this patch moves CompilerIntrinsicsLib from ArmPkg to MdePkg as this library provides compiler intrinsics, which are industry standard. This aligns with the goal of integrating ArmPkg into existing packages: https://bugzilla.tianocore.org/show_bug.cgi?id=4121. The newly placed CompilerIntrinsicsLib is added to MdeLibs.dsc.inc as every DSC that builds ARM/AARCH64 needs this library added. The old location is removed from every DSC in edk2 in this commit also to not break bisectability with minimal hoop jumping. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Oliver Smith-Denny <osde@linux.microsoft.com>
* NetworkPkg/MnpDxe: Convert TX buffer allocation messages to DEBUG_VERBOSEMike Beaton2024-09-111-1/+1
| | | | | | | | | | Under normal operation, some 30 or so of these lines logged as DEBUG_INFO on first transmit. This is not relevant information for users of the driver, so convert these messages to VERBOSE. Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* Support Report Status Code in the UefiPxe driver.yhsu32024-09-114-0/+16
| | | | | | | | | | | Report PXE error status via Status Code, with this design, it will be flexible to register a status code handler via gEfiRscHandlerProtocolGuid to output the customized error code to other telemetry service. The subclass code is `EFI_IO_BUS_IP_NETWORK` Signed-off-by: Ethan Hsu <Eathonhsu@gmail.com>
* NetworkPkg/DxeNetLib: Update misleading commentMike Beaton2024-09-091-4/+10
| | | | | | | | | | | | | | | Commit 6862b9d538d96363635677198899e1669e591259 makes more explicit the previous logic of the code anyway, which is that it is (and was) only a fatal error if all secure algorithms fail. However the comment updated by this commit seems somewhat incompatible with that change, and even with the previous code (which operated as now, just logging different error messages). This updates the comment to be more compatible with how the code operates. Signed-off-by: Mike Beaton <mjsbeaton@gmail.com>
* NetworkPkg/WifiConnectionManagerDxe: Fix Connection Manager HII errorsNeo Hsueh2024-09-031-33/+1
| | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4824 Fix the wrong logic in WifiMgrDxeHiiConfigAccessCallback with EFI_BROWSER_ACTION_CHANGING action. Cc: Jiangang He <jiangang.he@amd.com> Cc: Abner Chang <abner.chang@amd.com> Signed-off-by: Neo Hsueh <Hong-Chih.Hsueh@amd.com>
* NetworkPkg/NetworkPkg.ci.yaml: Add PrEval CI configJoey Vagedes2024-09-021-0/+3
| | | | | | | | | | | Adds an entry to the package's CI configuration file that enable policy 5 for stuart_pr_eval. With this Policy, all INFs used by the package are extracted from the provided DSC file and compared against the list of changed *.inf (INF) files in the PR. If there is a match, stuart_pr_eval will specify that this package is affected by the PR and needs to be tested. Signed-off-by: Joey Vagedes <joey.vagedes@gmail.com>
* NetworkPkg/SnpDxe: return error for unsupported parameterNickle Wang2024-09-021-3/+6
| | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4729 From SCT testing report, Reset() does not support the case when ExtendedVerification is set to FALSE. So, we should return EFI_INVALID_PARAMETER in this case. For details, please refer to Bug 4729. Signed-off-by: Nickle Wang <nicklew@nvidia.com>
* NetworkPkg: DxeHttpLib: Use HTTP error 429Ken Lautner2024-09-022-0/+8
| | | | | | | | Include a mapping for HTTP error 429 to return the correct status code. Additionally include a link to the official HTTP status codes in the HttpMappingToStatusCode function header. Signed-off-by: Kenneth Lautner <kenlautner3@gmail.com>
* NetworkPkg: Improve GetBootFile() code flowSaloni Kasbekar2024-08-272-60/+122
| | | | | | | | Introduce state machine to improve the code flow in GetBootFile() to make it more readable. Allows new states to be easily added without adding further nested ifs. Signed-off-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg/DxeHttpLib: Support HTTP CONNECT message in Tx path.Saloni Kasbekar2024-08-071-0/+5
| | | | | | Add HTTP CONNECT message support in HttpGenRequestMessage() Signed-off-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg/HttpDxe: Track HttpInstance URL buffer length.Saloni Kasbekar2024-07-113-7/+14
| | | | | | | | | In EfiHttpRequest(), length of target URLs was always compared to fixed-size value, even after allocating a larger URL buffer. Added UrlLen to HTTP_PROTOCOL to store the size and reallocate if the size changes. Signed-off-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg/DxeNetLib: adjust PseudoRandom error loggingGerd Hoffmann2024-06-271-1/+2
| | | | | | | | | | | | There is a list of allowed rng algorithms, if /one/ of them is not supported this is not a problem, only /all/ of them failing is an error condition. Downgrade the message for a single unsupported algorithm from ERROR to VERBOSE. Add an error message in case we finish the loop without finding a supported algorithm. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environmentSam2024-05-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This bug fix is based on the following commit "NetworkPkg TcpDxe: SECURITY PATCH" REF: 1904a64 Issue Description: An "Invalid handle" error was detected during runtime when attempting to destroy a child instance of the hashing protocol. The problematic code segment was: NetworkPkg\TcpDxe\TcpDriver.c Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, ​&mHash2ServiceHandle); Root Cause Analysis: The root cause of the error was the passing of an incorrect parameter type, a pointer to an EFI_HANDLE instead of an EFI_HANDLE itself, to the DestroyChild function. This mismatch resulted in the function receiving an invalid handle. Implemented Solution: To resolve this issue, the function call was corrected to pass mHash2ServiceHandle directly: NetworkPkg\TcpDxe\TcpDriver.c Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, mHash2ServiceHandle); This modification ensures the correct handle type is used, effectively rectifying the "Invalid handle" error. Verification: Testing has been conducted, confirming the efficacy of the fix. Additionally, the BIOS can boot into the OS in an iPXE environment. Cc: Doug Flick [MSFT] <doug.edk2@gmail.com> Signed-off-by: Sam Tsai [Wiwynn] <sam_tsai@wiwynn.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Update the PxeBcDhcp6GoogleTest due to underlying changesDoug Flick2024-05-243-6/+100
| | | | | | | | | | | | | This patch updates the PxeBcDhcp6GoogleTest due to the changes in the underlying code. The changes are as follows: - Random now comes from the RngLib Protocol - The TCP ISN is now generated by the hash function Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg TcpDxe: SECURITY PATCH CVE-2023-45236Doug Flick2024-05-248-49/+415
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4541 REF: https://www.rfc-editor.org/rfc/rfc1948.txt REF: https://www.rfc-editor.org/rfc/rfc6528.txt REF: https://www.rfc-editor.org/rfc/rfc9293.txt Bug Overview: PixieFail Bug #8 CVE-2023-45236 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Updates TCP ISN generation to use a cryptographic hash of the connection's identifying parameters and a secret key. This prevents an attacker from guessing the ISN used for some other connection. This is follows the guidance in RFC 1948, RFC 6528, and RFC 9293. RFC: 9293 Section 3.4.1. Initial Sequence Number Selection A TCP implementation MUST use the above type of "clock" for clock- driven selection of initial sequence numbers (MUST-8), and SHOULD generate its initial sequence numbers with the expression: ISN = M + F(localip, localport, remoteip, remoteport, secretkey) where M is the 4 microsecond timer, and F() is a pseudorandom function (PRF) of the connection's identifying parameters ("localip, localport, remoteip, remoteport") and a secret key ("secretkey") (SHLD-1). F() MUST NOT be computable from the outside (MUST-9), or an attacker could still guess at sequence numbers from the ISN used for some other connection. The PRF could be implemented as a cryptographic hash of the concatenation of the TCP connection parameters and some secret data. For discussion of the selection of a specific hash algorithm and management of the secret key data, please see Section 3 of [42]. For each connection there is a send sequence number and a receive sequence number. The initial send sequence number (ISS) is chosen by the data sending TCP peer, and the initial receive sequence number (IRS) is learned during the connection-establishing procedure. For a connection to be established or initialized, the two TCP peers must synchronize on each other's initial sequence numbers. This is done in an exchange of connection-establishing segments carrying a control bit called "SYN" (for synchronize) and the initial sequence numbers. As a shorthand, segments carrying the SYN bit are also called "SYNs". Hence, the solution requires a suitable mechanism for picking an initial sequence number and a slightly involved handshake to exchange the ISNs. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: SECURITY PATCH CVE-2023-45237Doug Flick2024-05-2427-83/+410
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4542 Bug Overview: PixieFail Bug #9 CVE-2023-45237 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Use of a Weak PseudoRandom Number Generator Change Overview: Updates all Instances of NET_RANDOM (NetRandomInitSeed ()) to either > > EFI_STATUS > EFIAPI > PseudoRandomU32 ( > OUT UINT32 *Output > ); > or (depending on the use case) > > EFI_STATUS > EFIAPI > PseudoRandom ( > OUT VOID *Output, > IN UINTN OutputLength > ); > This is because the use of Example: The following code snippet PseudoRandomU32 () function is used: > > UINT32 Random; > > Status = PseudoRandomU32 (&Random); > if (EFI_ERROR (Status)) { > DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status)); > return Status; > } > This also introduces a new PCD to enable/disable the use of the secure implementation of algorithms for PseudoRandom () and instead depend on the default implementation. This may be required for some platforms where the UEFI Spec defined algorithms are not available. > > PcdEnforceSecureRngAlgorithms > If the platform does not have any one of the UEFI defined secure RNG algorithms then the driver will assert. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg/WifiConnectionManagerDxe: Update UI according to UEFI specLiqi Liu2024-04-161-39/+74
| | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4736 In UEFI_Spec_2_10_Aug29.pdf page 1694 section 35.5.4 for EFI_BROWSER_ACTION_FORM_OPEN: NOTE: EFI_FORM_BROWSER2_PROTOCOL.BrowserCallback() cannot be used with this browser action because question values have not been retrieved yet. So should not call HiiGetBrowserData() and HiiSetBrowserData() in FORM_OPEN call back function. Now use wifi list key and enroll cert key instead of the connect action key, move wifi info display from open action to close action. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Cc: Dandan Bi <dandan.bi@intel.com> Cc: Felix Polyudov <Felixp@ami.com> Signed-off-by: Liqi Liu <liqi.liu@intel.com> Reviewed-by: Zachary Clark-williams <zachary.clark-williams@intel.com> Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
* NetworkPkg: : Updating SecurityFixes.yamlDoug Flick2024-02-141-0/+1
| | | | | | | | | | | This captures the related security change for Dhcp6Dxe that is related to CVE-2023-45229 Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com> Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
* NetworkPkg: Dhcp6Dxe: Packet-Length is not updated before appendingDoug Flick2024-02-141-5/+5
| | | | | | | | | | | | In order for Dhcp6AppendIaAddrOption (..) to safely append the IA Address option, the Packet-Length field must be updated before appending the option. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com> Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
* NetworkPkg: Dhcp6Dxe: Removes duplicate check and replaces with macroDoug Flick2024-02-141-25/+19
| | | | | | | | | | | | | | | | | | | | | | | | | Removes duplicate check after merge > > // > // Verify the PacketCursor is within the packet > // > if ( (*PacketCursor < Packet->Dhcp6.Option) > || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER)))) > { > return EFI_INVALID_PARAMETER; > } > Converts the check to a macro and replaces all instances of the check with the macro Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com> Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
* NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Related PatchDoug Flick2024-02-142-17/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4673 REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534 This was not part of the Quarkslab bugs however the same pattern as CVE-2023-45229 exists in Dhcp6UpdateIaInfo. This patch replaces the code in question with the safe function created to patch CVE-2023-45229 > > if (EFI_ERROR ( > Dhcp6SeekInnerOptionSafe ( > Instance->Config->IaDescriptor.Type, > Option, > OptionLen, > &IaInnerOpt, > &IaInnerLen > ) > )) > { > return EFI_DEVICE_ERROR; > } > Additionally corrects incorrect usage of macro to read the status > - StsCode = NTOHS (ReadUnaligned16 ((UINT16 *)DHCP6_OFFSET_OF_OPT_LEN (Option))); > + StsCode = NTOHS (ReadUnaligned16 ((UINT16 *) DHCP6_OFFSET_OF_STATUS_CODE (Option)); Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com> Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
* NetworkPkg: : Adds a SecurityFix.yaml fileDoug Flick via groups.io2024-02-061-0/+123
| | | | | | | | | | | | This creates / adds a security file that tracks the security fixes found in this package and can be used to find the fixes that were applied. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 Unit TestsDoug Flick2024-02-063-3/+298
| | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4540 Unit tests to confirm that the bug.. Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message ..has been patched. This patch contains unit tests for the following functions: PxeBcRequestBootService PxeBcDhcp6Discover Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45235 PatchDoug Flick2024-02-062-16/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4540 Bug Details: PixieFail Bug #7 CVE-2023-45235 CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message Change Overview: Performs two checks 1. Checks that the length of the duid is accurate > + // > + // Check that the minimum and maximum requirements are met > + // > + if ((OpLen < PXEBC_MIN_SIZE_OF_DUID) || (OpLen > PXEBC_MAX_SIZE_OF_DUID)) { > + Status = EFI_INVALID_PARAMETER; > + goto ON_ERROR; > + } 2. Ensures that the amount of data written to the buffer is tracked and never exceeds that > + // > + // Check that the option length is valid. > + // > + if ((DiscoverLen + OpLen + PXEBC_COMBINED_SIZE_OF_OPT_CODE_AND_LEN) > DiscoverLenNeeded) { > + Status = EFI_OUT_OF_RESOURCES; > + goto ON_ERROR; > + } Additional code clean up and fix for memory leak in case Option was NULL Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234 Unit TestsDoug Flick2024-02-065-0/+418
| | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4539 Unit tests to that the bug.. Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message ..has been patched This contains tests for the following functions: PxeBcHandleDhcp6Offer PxeBcCacheDnsServerAddresses Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234 PatchDoug Flick2024-02-061-6/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4539 Bug Details: PixieFail Bug #6 CVE-2023-45234 CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message Change Overview: Introduces a function to cache the Dns Server and perform sanitizing on the incoming DnsServerLen to ensure that the length is valid > + EFI_STATUS > + PxeBcCacheDnsServerAddresses ( > + IN PXEBC_PRIVATE_DATA *Private, > + IN PXEBC_DHCP6_PACKET_CACHE *Cache6 > + ) Additional code cleanup Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 Unit TestsDoug Flick2024-02-063-4/+324
| | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4537 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4538 Unit tests to confirm that.. Infinite loop when parsing unknown options in the Destination Options header and Infinite loop when parsing a PadN option in the Destination Options header ... have been patched This patch tests the following functions: Ip6IsOptionValid Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45232 PatchDoug Flick2024-02-063-11/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4537 REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4538 Bug Details: PixieFail Bug #4 CVE-2023-45232 CVSS 7.5 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') Infinite loop when parsing unknown options in the Destination Options header PixieFail Bug #5 CVE-2023-45233 CVSS 7.5 : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') Infinite loop when parsing a PadN option in the Destination Options header Change Overview: Most importantly this change corrects the following incorrect math and cleans up the code. > // It is a PadN option > // > - Offset = (UINT8)(Offset + *(Option + Offset + 1) + 2); > + OptDataLen = ((EFI_IP6_OPTION *)(Option + Offset))->Length; > + Offset = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen); > case Ip6OptionSkip: > - Offset = (UINT8)(Offset + *(Option + Offset + 1)); > OptDataLen = ((EFI_IP6_OPTION *)(Option + Offset))->Length; > Offset = IP6_NEXT_OPTION_OFFSET (Offset, OptDataLen); Additionally, this change also corrects incorrect math where the calling function was calculating the HDR EXT optionLen as a uint8 instead of a uint16 > - OptionLen = (UINT8)((*Option + 1) * 8 - 2); > + OptionLen = IP6_HDR_EXT_LEN (*Option) - IP6_COMBINED_SIZE_OF_NEXT_HDR_AND_LEN; Additionally this check adds additional logic to santize the incoming data Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit TestsDoug Flick2024-02-064-0/+192
| | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536 Validates that the patch for... Out-of-bounds read when handling a ND Redirect message with truncated options .. has been fixed Tests the following function to ensure that an out of bounds read does not occur Ip6OptionValidation Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 PatchDoug Flick2024-02-061-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536 Bug Overview: PixieFail Bug #3 CVE-2023-45231 CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-125 Out-of-bounds Read Out-of-bounds read when handling a ND Redirect message with truncated options Change Overview: Adds a check to prevent truncated options from being parsed + // + // Cannot process truncated options. + // Cannot process options with a length of 0 as there is no Type field. + // + if (OptionLen < sizeof (IP6_OPTION_HEADER)) { + return FALSE; + } Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 Unit TestsDoug Flick via groups.io2024-02-065-3/+424
| | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534 These tests confirm that the report bug... "Out-of-bounds read when processing IA_NA/IA_TA options in a DHCPv6 Advertise message" ..has been patched. The following functions are tested to confirm an out of bounds read is patched and that the correct statuses are returned: Dhcp6SeekInnerOptionSafe Dhcp6SeekStsOption TCBZ4534 CVE-2023-45229 CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-125 Out-of-bounds Read Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45229 PatchDoug Flick via groups.io2024-02-062-85/+256
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4534 Bug Details: PixieFail Bug #1 CVE-2023-45229 CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-125 Out-of-bounds Read Change Overview: Introduce Dhcp6SeekInnerOptionSafe which performs checks before seeking the Inner Option from a DHCP6 Option. > > EFI_STATUS > Dhcp6SeekInnerOptionSafe ( > IN UINT16 IaType, > IN UINT8 *Option, > IN UINT32 OptionLen, > OUT UINT8 **IaInnerOpt, > OUT UINT16 *IaInnerLen > ); > Lots of code cleanup to improve code readability. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 Unit TestsDoug Flick via groups.io2024-02-064-0/+542
| | | | | | | | | | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4535 Confirms that reported issue... "Buffer overflow in the DHCPv6 client via a long Server ID option" ..has been corrected by the provided patch. Tests the following functions to ensure they appropriately handle untrusted data (either too long or too small) to prevent a buffer overflow: Dhcp6AppendOption Dhcp6AppendETOption Dhcp6AppendIaOption Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: : Add Unit tests to CI and create Host Test DSCDoug Flick via groups.io2024-02-062-1/+104
| | | | | | | | | | Adds Host Based testing to the NetworkPkg Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
* NetworkPkg: Dhcp6Dxe: SECURITY PATCH CVE-2023-45230 PatchDoug Flick via groups.io2024-02-064-239/+668
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4535 Bug Details: PixieFail Bug #2 CVE-2023-45230 CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Changes Overview: > -UINT8 * > +EFI_STATUS > Dhcp6AppendOption ( > - IN OUT UINT8 *Buf, > - IN UINT16 OptType, > - IN UINT16 OptLen, > - IN UINT8 *Data > + IN OUT EFI_DHCP6_PACKET *Packet, > + IN OUT UINT8 **PacketCursor, > + IN UINT16 OptType, > + IN UINT16 OptLen, > + IN UINT8 *Data > ); Dhcp6AppendOption() and variants can return errors now. All callsites are adapted accordingly. It gets passed in EFI_DHCP6_PACKET as additional parameter ... > + // > + // Verify the PacketCursor is within the packet > + // > + if ( (*PacketCursor < Packet->Dhcp6.Option) > + || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER)))) > + { > + return EFI_INVALID_PARAMETER; > + } ... so it can look at Packet->Size when checking buffer space. Also to allow Packet->Length updates. Lots of checks added. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 16:51:23 +0000