Attachment 871512 Details for Bug 1215102

[patch] CVE-2023-40550-2 codes from keybase

CVE-2023-40550-pe-Fix-an-out-of-bound-read-in-verify.patch (text/plain), 1.53 KB, created by Tseng on 2023-12-21 15:13:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tseng

Created: 2023-12-21 15:13:34 UTC

Size: 1.53 KB

patch

obsolete

>From 16390b3c5c0497f82809f4057e3af8b9b683d3ab Mon Sep 17 00:00:00 2001
>From: Peter Jones <pjones@redhat.com>
>Date: Thu, 27 Jul 2023 14:57:32 -0400
>Subject: [PATCH] CVE-2023-40550 pe: Fix an out-of-bound read in
> verify_buffer_sbat()
>
>In verify_buffer_sbat(), we have a goal-seeking loop to find the .sbat
>section header.  Unfortunately, while the actual contents of the section
>are checked for being inside the binary, no such check exists for the
>contents of the section table entry.
>
>As a result, a carefully constructed binary will cause an out-of-bounds
>read checking if the section name is ".sbat\0\0\0" or not.
>
>This patch adds a check that each section table entry is within the
>bounds of the binary.
>
>It's not currently known if this is actually exploitable beyond creating
>a denial of service, and an attacker who is in a position to use it for
>a denial of service attack must already be able to do so.
>
>Resolves: CVE-2023-40550
>Reported-by: gkirkpatrick@google.com
>Not-Yet-Signed-off-by: Peter Jones <pjones@redhat.com>
>---
> shim.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
>diff --git a/shim.c b/shim.c
>index 01e5e56..3a97067 100644
>--- a/shim.c
>+++ b/shim.c
>@@ -709,6 +709,11 @@ verify_buffer_sbat (char *data, int datasize,
> 
> 	Section = context->FirstSection;
> 	for (i = 0; i < context->NumberOfSections; i++, Section++) {
>+		if ((uint64_t)&Section[1] > (uint64_t)data + datasize) {
>+			perror(L"Section exceeds bounds of image\n");
>+			return EFI_UNSUPPORTED;
>+		}
>+
> 		if (CompareMem(Section->Name, ".sbat\0\0\0", 8) != 0)
> 			continue;
> 
>-- 
>2.31.1
>

Actions: View | Diff

Attachments on bug 1215102: 871410 | 871509 | 871512