Fix CVE-2021-28211
This commit is contained in:
miaoyubo
parent
acaaf2ef34
commit
b8316529d8
@ -0,0 +1,93 @@
|
||||
From e7bd0dd26db7e56aa8ca70132d6ea916ee6f3db0 Mon Sep 17 00:00:00 2001
|
||||
From: Laszlo Ersek <lersek@redhat.com>
|
||||
Date: Thu, 19 Nov 2020 12:50:34 +0100
|
||||
Subject: [PATCH] MdeModulePkg/LzmaCustomDecompressLib: catch 4GB+ uncompressed
|
||||
buffer sizes
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The LzmaUefiDecompressGetInfo() function
|
||||
[MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c] currently
|
||||
silently truncates the UINT64 "DecodedSize" property of the compressed
|
||||
blob to the UINT32 "DestinationSize" output parameter.
|
||||
|
||||
If "DecodedSize" is 0x1_0000_0100, for example, then the subsequent memory
|
||||
allocation (for decompression) will likely succeed (allocating 0x100 bytes
|
||||
only), but then the LzmaUefiDecompress() function (which re-fetches the
|
||||
uncompressed buffer size from the same LZMA header into a "SizeT"
|
||||
variable) will overwrite the buffer.
|
||||
|
||||
Catch (DecodedSize > MAX_UINT32) in LzmaUefiDecompressGetInfo() at once.
|
||||
This should not be a practical limitation. (The issue cannot be fixed for
|
||||
32-bit systems without spec modifications anyway, given that the
|
||||
"OutputSize" output parameter of
|
||||
EFI_GUIDED_SECTION_EXTRACTION_PROTOCOL.ExtractSection() has type UINTN,
|
||||
not UINT64.)
|
||||
|
||||
Cc: Dandan Bi <dandan.bi@intel.com>
|
||||
Cc: Hao A Wu <hao.a.wu@intel.com>
|
||||
Cc: Jian J Wang <jian.j.wang@intel.com>
|
||||
Cc: Liming Gao <gaoliming@byosoft.com.cn>
|
||||
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
|
||||
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1816
|
||||
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
||||
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
|
||||
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
||||
Message-Id: <20201119115034.12897-2-lersek@redhat.com>
|
||||
---
|
||||
.../Library/LzmaCustomDecompressLib/LzmaDecompress.c | 7 +++++++
|
||||
.../LzmaCustomDecompressLib/LzmaDecompressLibInternal.h | 5 +++++
|
||||
2 files changed, 12 insertions(+)
|
||||
|
||||
diff --git a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c
|
||||
index c58912eb6a..8f7c242dca 100644
|
||||
--- a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c
|
||||
+++ b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompress.c
|
||||
@@ -127,6 +127,10 @@ GetDecodedSizeOfBuf(
|
||||
in DestinationSize and the size of the scratch
|
||||
buffer was returned in ScratchSize.
|
||||
|
||||
+ @retval RETURN_UNSUPPORTED DestinationSize cannot be output because the
|
||||
+ uncompressed buffer size (in bytes) does not fit
|
||||
+ in a UINT32. Output parameters have not been
|
||||
+ modified.
|
||||
**/
|
||||
RETURN_STATUS
|
||||
EFIAPI
|
||||
@@ -142,6 +146,9 @@ LzmaUefiDecompressGetInfo (
|
||||
ASSERT(SourceSize >= LZMA_HEADER_SIZE);
|
||||
|
||||
DecodedSize = GetDecodedSizeOfBuf((UINT8*)Source);
|
||||
+ if (DecodedSize > MAX_UINT32) {
|
||||
+ return RETURN_UNSUPPORTED;
|
||||
+ }
|
||||
|
||||
*DestinationSize = (UINT32)DecodedSize;
|
||||
*ScratchSize = SCRATCH_BUFFER_REQUEST_SIZE;
|
||||
diff --git a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h
|
||||
index 26f110ba2a..fbafd5f100 100644
|
||||
--- a/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h
|
||||
+++ b/MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaDecompressLibInternal.h
|
||||
@@ -9,6 +9,7 @@
|
||||
#ifndef __LZMADECOMPRESSLIB_INTERNAL_H__
|
||||
#define __LZMADECOMPRESSLIB_INTERNAL_H__
|
||||
|
||||
+#include <Base.h>
|
||||
#include <PiPei.h>
|
||||
#include <Library/BaseLib.h>
|
||||
#include <Library/BaseMemoryLib.h>
|
||||
@@ -45,6 +46,10 @@
|
||||
in DestinationSize and the size of the scratch
|
||||
buffer was returned in ScratchSize.
|
||||
|
||||
+ @retval RETURN_UNSUPPORTED DestinationSize cannot be output because the
|
||||
+ uncompressed buffer size (in bytes) does not fit
|
||||
+ in a UINT32. Output parameters have not been
|
||||
+ modified.
|
||||
**/
|
||||
RETURN_STATUS
|
||||
EFIAPI
|
||||
--
|
||||
2.27.0
|
||||
|
||||
@ -5,7 +5,7 @@
|
||||
|
||||
Name: edk2
|
||||
Version: %{stable_date}
|
||||
Release: 7
|
||||
Release: 8
|
||||
Summary: EFI Development Kit II
|
||||
License: BSD-2-Clause-Patent
|
||||
URL: https://github.com/tianocore/edk2
|
||||
@ -28,6 +28,7 @@ Patch0013: 0013-ArmVirtPkg-ArmVirtQemu-enable-TPM2-based-measured-bo.patch
|
||||
Patch0014: 0014-MdeModulePkg-Core-Dxe-assert-SectionInstance-invariant-in-FindChildNode.patch
|
||||
Patch0015: 0015-MdeModulePkg-Core-Dxe-limit-FwVol-encapsulation-section-recursion.patch
|
||||
Patch0016: 0016-ArmPkg-CompilerIntrinsicsLib-provide-atomics-intrins.patch
|
||||
Patch0017: 0017-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch
|
||||
|
||||
BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python3-unversioned-command
|
||||
|
||||
@ -225,6 +226,9 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Aug 31 2021 miaoyubo <miaoyubo@huawei.com> - 202002-8
|
||||
- MdeModulePkg/LzmaCustomDecompressLib: catch 4GB+ uncompressed
|
||||
|
||||
* Fri Jul 30 2021 Zhenyu Ye <yezhenyu2@huawei.com> - 202002-7
|
||||
- ArmPkg/CompilerIntrinsicsLib: provide atomics intrinsics
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user