Attachment 871408 Details for Bug 1215100

shim commit CVE-2023-40548 from keybase

sbat-size-40548.txt (text/plain), 1.42 KB, created by Tseng on 2023-12-18 06:31:38 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tseng

Created: 2023-12-18 06:31:38 UTC

Size: 1.42 KB

patch

obsolete

>commit 46142e0a3c3097375bc5c6100d4451e71c8adb69
>Author: Peter Jones <pjones@redhat.com>
>Date:   Thu Jul 27 15:21:31 2023 -0400
>
>    CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system
>    
>    In verify_sbat_section(), we do some math on data that comes from the
>    binary being verified - in this case, we add 1 to the size of the
>    ".sbat" section as reported in the section header, which is then used as
>    the input to the size of an allocation.  The original value is then used
>    for a size in a memcpy(), which means there's an out-of-bounds write in
>    the overflow case.
>    
>    Due to the type of the variable being size_t, but the type in the
>    section header being uint32_t, this is only plausibly accomplished on
>    32-bit systems.
>    
>    This patch makes the arithmetic use a checked add operation to avoid
>    overflow.  Additionally, it adds a check in verify_buffer_sbat() to
>    guarantee that the data is within the binary.
>    
>    It's not currently known if this is actually exploitable on such
>    systems; the memory layout on a particular machine may further mitigate
>    this scenario.
>    
>    Resolves: CVE-2023-40548
>    Reported-by: gkirkpatrick@google.com
>    Not-Yet-Signed-off-by: Peter Jones <pjones@redhat.com>
>
>diff --git a/pe.c b/pe.c
>index e15b89f..b3a9d46 100644
>--- a/pe.c
>+++ b/pe.c
>@@ -355,7 +355,11 @@ verify_sbat_section(char *SBATBase, size_t SBATSize)
>lines 1-34/68 52%

Actions: View

Attachments on bug 1215100: 871408 | 871506