Attachment 871406 Details for Bug 1215099

shim commit CVE-2023-40546

LogError-40546.txt (text/plain), 1.34 KB, created by Tseng on 2023-12-18 05:19:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tseng

Created: 2023-12-18 05:19:34 UTC

Size: 1.34 KB

patch

obsolete

>commit b4cba3234467471a64f3067783b624f4fdffc125
>Author: Peter Jones <pjones@redhat.com>
>Date:   Wed Aug 2 14:36:09 2023 -0400
>
>    Further mitigations against CVE-2023-40546 as a class
>    
>    In CVE-2023-40546, an incorrect invocation of LogError()
>    causes a read from the page at address 0, which on newer systems will
>    correctly cause a fault.  The immediate fix for this CVE is to fix the
>    invocation so that the error is logged correctly, but there is more that
>    can be done.
>    
>    This patch adds additional checks to ensure that the format specifier on
>    any of these invocations can not be NULL, thereby mitigating this entire
>    class of error from creating a fault.  Additionally, most of these
>    checks are done using _Static_assert(), so they should normally be
>    triggered at compile time.
>    
>    Signed-off-by: Peter Jones <pjones@redhat.com>
>
>diff --git a/errlog.c b/errlog.c
>index cc6a89f..3c5e0af 100644
>--- a/errlog.c
>+++ b/errlog.c
>@@ -32,6 +32,9 @@ VLogError(const char *file, int line, const char *func, const CHAR16 *fmt,
>        ms_va_list args2;
>        CHAR16 **newerrs;
> 
>+       if (file == NULL || func == NULL || fmt == NULL)
>+               return EFI_INVALID_PARAMETER;
>+
>        newerrs = ReallocatePool(errs, (nerrs + 1) * sizeof(*errs),
>                                       (nerrs + 3) * sizeof(*errs));
>lines 1-33

Actions: View

Attachments on bug 1215099: 871406 | 871500