Attachment 871405 Details for Bug 1215098

original committed file from keybase

http-header-40547.txt (text/plain), 1.23 KB, created by Tseng on 2023-12-18 02:04:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tseng

Created: 2023-12-18 02:04:33 UTC

Size: 1.23 KB

patch

obsolete

>    allocate a buffer to store the received data.  Unfortunately, this means
>    getting the size from an HTTP header, which can be manipulated to
>    specify a size that's smaller than the received data.  In this case, the
>    code accidentally uses the header for the allocation but the protocol
>    metadata to copy it from the rx buffer, resulting in an out-of-bounds
>    write.
>    
>    This patch adds an additional check to test that the rx buffer is not
>    larger than the allocation.
>    
>    Resolves: CVE-2023-40547
>    Reported-by: Bill Demirkapi, Microsoft Security Response Center
>    Signed-off-by: Peter Jones <pjones@redhat.com>
>
>diff --git a/httpboot.c b/httpboot.c
>index dfa493b..b34dd49 100644
>--- a/httpboot.c
>+++ b/httpboot.c
>@@ -578,7 +578,13 @@ receive_http_response(EFI_HTTP_PROTOCOL *http, VOID **buffer, UINT64 *buf_size)
>        }
> 
>        if (*buf_size == 0) {
>-               perror(L"Failed to get Content-Lenght\n");
>+               perror(L"Failed to get Content-Length\n");
>+               goto error;
>+       }
>+
>+       if (*buf_size < rx_message.BodyLength) {
>+               efi_status = EFI_BAD_BUFFER_SIZE;
>+               perror(L"Invalid Content-Length\n");
>                goto error;
>        }
> 
>lines 8-40/40 (END)

Actions: View

Attachments on bug 1215098: 871405 | 871501