packages/edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix CVE-2023-0401

Browse Source
This commit is contained in:
s00803682 2023-02-25 18:27:28 +08:00
parent f6a7530990
commit 1506bbc136
3 changed files with 64 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
0023-PATCH-Avoid-dangling-ptrs-in-header-and-data-params-.patch
View File

@ -1,5 +1,5 @@
From a114dc3c9af48a8f8ed22e738944a9c3e830a088 Mon Sep 17 00:00:00 2001
From: s00803682 <shaodenghui@huawei.com>
From Shao Denghui <shaodenghui@huawei.com>
Date: Mon, 20 Feb 2023 21:59:31 +0800
Subject: [PATCH] [PATCH] Avoid dangling ptrs in header and data params for
PEM_read_bio_ex In the event of a failure in PEM_read_bio_ex() we free the
@ -19,7 +19,7 @@ Reference: https://github.com/openssl/openssl/commit/ee6243f3947107d655f6dee96f6
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Signed-off-by: s00803682 <shaodenghui@huawei.com>
Signed-off-by: Shao Denghui <shaodenghui@huawei.com>
---
CryptoPkg/Library/OpensslLib/openssl/crypto/pem/pem_lib.c | 2 ++
1 file changed, 2 insertions(+)

57
0024-PATCH-pk7_doit.c-Check-return-of-BIO_set_md-calls.patch Normal file
View File

@ -0,0 +1,57 @@
From 7dd5a23212e3c7bf25a9cd7689681beb89b2d20f Mon Sep 17 00:00:00 2001
From Shao Denghui <shaodenghui@huawei.com>
Date: Tue, 21 Feb 2023 20:12:59 +0800
Subject: [PATCH] [PATCH] pk7_doit.c: Check return of BIO_set_md() calls
These calls invoke EVP_DigestInit() which can fail for digests
with implicit fetches. Subsequent EVP_DigestUpdate() from BIO_write()
or EVP_DigestFinal() from BIO_read() will segfault on NULL
dereference. This can be triggered by an attacker providing
PKCS7 data digested with MD4 for example if the legacy provider
is not loaded.
If BIO_set_md() fails the md BIO cannot be used.
CVE-2023-0401
Reference: https://github.com/openssl/openssl/commit/6eebe6c0238178356114a96a7858f36b24172847
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Richard Levitte <levitte@openssl.org>
Signed-off-by: Shao Denghui <shaodenghui@huawei.com>
---
.../Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
index f63fbc5..bbfcf27 100644
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/pkcs7/pk7_doit.c
@@ -67,7 +67,10 @@ static int PKCS7_bio_add_digest(BIO **pbio, X509_ALGOR *alg)
goto err;
}
- BIO_set_md(btmp, md);
+ if (BIO_set_md(btmp, md) <= 0) {
+ PKCS7err(PKCS7_F_PKCS7_BIO_ADD_DIGEST, ERR_R_BIO_LIB);
+ goto err;
+ }
if (*pbio == NULL)
*pbio = btmp;
else if (!BIO_push(*pbio, btmp)) {
@@ -454,7 +457,10 @@ BIO *PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
goto err;
}
- BIO_set_md(btmp, evp_md);
+ if (BIO_set_md(btmp, evp_md) <= 0) {
+ PKCS7err(PKCS7_F_PKCS7_DATADECODE, ERR_R_BIO_LIB);
+ goto err;
+ }
if (out == NULL)
out = btmp;
else
--
2.27.0

6
edk2.spec
View File

@ -5,7 +5,7 @@
Name: edk2
Version: %{stable_date}
Release: 8
Release: 9
Summary: EFI Development Kit II
License: BSD-2-Clause-Patent
URL: https://github.com/tianocore/edk2
@ -44,6 +44,7 @@ Patch0021: 0021-UefiCpuPkg-Move-MigrateGdt-from-DiscoverMemory-to-Te.patch
Patch0022: 0022-MdeModulePkg-PiSmmCore-SmmEntryPoint-underflow-CVE-2.patch
Patch0023: 0023-PATCH-Avoid-dangling-ptrs-in-header-and-data-params-.patch
Patch0024: 0024-PATCH-pk7_doit.c-Check-return-of-BIO_set_md-calls.patch
BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python3-unversioned-command
%description
@ -244,6 +245,9 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys
%endif
%changelog
* Sat Feb 25 2023 shaodenghui<shaodenghui@huawei.com> - 202011-9
- fix CVE-2023-0401
* Mon Feb 20 2023 shaodenghui<shaodenghui@huawei.com> - 202011-8
- fix CVE-2022-4450