Attachment 871501 Details for Bug 1215098

[patch] CVE-2023-40547 codes from keybase

CVE-2023-40547-avoid-incorrectly-trusting-HTTP-heade.patch (text/plain), 1.43 KB, created by Tseng on 2023-12-21 09:07:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tseng

Created: 2023-12-21 09:07:11 UTC

Size: 1.43 KB

patch

obsolete

>From 610523e702f0c6c8bed4658928aa3b5ffe74d023 Mon Sep 17 00:00:00 2001
>From: Peter Jones <pjones@redhat.com>
>Date: Wed, 2 Aug 2023 14:19:31 -0400
>Subject: [PATCH] CVE-2023-40547 - avoid incorrectly trusting HTTP headers
>
>When retrieving files via HTTP or related protocols, shim attempts to
>allocate a buffer to store the received data.  Unfortunately, this means
>getting the size from an HTTP header, which can be manipulated to
>specify a size that's smaller than the received data.  In this case, the
>code accidentally uses the header for the allocation but the protocol
>metadata to copy it from the rx buffer, resulting in an out-of-bounds
>write.
>
>This patch adds an additional check to test that the rx buffer is not
>larger than the allocation.
>
>Resolves: CVE-2023-40547
>Reported-by: Bill Demirkapi, Microsoft Security Response Center
>Signed-off-by: Peter Jones <pjones@redhat.com>
>---
> httpboot.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
>diff --git a/httpboot.c b/httpboot.c
>index dfa493b..b34dd49 100644
>--- a/httpboot.c
>+++ b/httpboot.c
>@@ -578,7 +578,13 @@ receive_http_response(EFI_HTTP_PROTOCOL *http, VOID **buffer, UINT64 *buf_size)
> 	}
> 
> 	if (*buf_size == 0) {
>-		perror(L"Failed to get Content-Lenght\n");
>+		perror(L"Failed to get Content-Length\n");
>+		goto error;
>+	}
>+
>+	if (*buf_size < rx_message.BodyLength) {
>+		efi_status = EFI_BAD_BUFFER_SIZE;
>+		perror(L"Invalid Content-Length\n");
> 		goto error;
> 	}
> 
>-- 
>2.31.1
>

Actions: View | Diff

Attachments on bug 1215098: 871405 | 871501