GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing github.com — SecurityPkg: Out of bound read in HashPeImageByType() by Flickdm · Pull Request #10928 · tianocore/edk2 Conversation
Contributor
DescriptionCVE: CVE-2024-38797 In HashPeImageByType(), the hash of a PE/COFF image is calculated. This function may get untrusted input. Inside this function, the following code verifies the loaded image has the correct format, by reading the second byte of the buffer. if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) { ... } Since the input image is not trusted, it may not have a second byte present to read. So this poses a potential out of bounds read error. With the below fix, we are ensuring that we don't perform an out of bound read. i.e, we make sure that AuthDataSize is greater than 1. if (AuthDataSize > 1 && (*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE){ ... } AuthDataSize size is verified before reading the second byte. So, if AuthDataSize is less than 2, the second byte will not be read, and the out of bound read will be prevented. The logic of the function was cleaned up to provide an early exit if the untrusted data does not have enough bytes to check for a TWO_BYTE_ENCODE or if the TWO_BYTE_ENCODE is not present. This is slightly more efficient than checking this condition in the for loop. Additionally, when the hash algorithm selected by Index has such a large OID that the OID Comparison couldn't be performed - this would lead to an early break rather than a OID Mismatch. This has been changed to a
How This Was TestedTested the patch on real platform with and without TPM connected and verified image is booting fine. Integration InstructionsN/A
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page. All reactions
Flickdm
force-pushed
the
security-advisory/cve-2024-38797/advisory
branch
3 times, most recently
from
bb1717f to
7ef3efe
Compare
jyao1
approved these changes
In HashPeImageByType(), the hash of PE/COFF image is calculated.
This function may get untrusted input.
Inside this function, the following code verifies the loaded image has
the correct format, by reading the second byte of the buffer.
```c
if ((*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE) {
...
}
```
The input image is not trusted and that may not have the second byte to
read. So this poses an out of bound read error.
With below fix we are assuring that we don't do out of bound read. i.e,
we make sure that AuthDataSize is greater than 1.
```c
if (AuthDataSize > 1
&& (*(AuthData + 1) & TWO_BYTE_ENCODE) != TWO_BYTE_ENCODE){
...
}
```
AuthDataSize size is verified before reading the second byte.
So if AuthDataSize is less than 2, the second byte will not be read, and
the out of bound read situation won't occur.
Tested the patch on real platform with and without TPM connected and
verified image is booting fine.
Authored-by: Raj AlwinX Selvaraj <[email protected]>
Signed-off-by: Doug Flick <[email protected]>
Namely:
(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
to TRUE for Index==0, then it will evaluate to TRUE for all other
Index values as well. As a result, the (Index == HASHALG_MAX)
condition will fire after the loop, and we'll return
EFI_UNSUPPORTED.
While this is correct, functionally speaking, it is wasteful to
keep re-checking TWO_BYTE_ENCODE in the loop body. The check
should be made at the top of the function, and EFI_UNSUPPORTED
should be returned at once, if appropriate.
(2) If the hash algorithm selected by Index has such a large OID that
the OID comparison cannot even be performed (because AuthDataSize
is not large enough for containing the OID in question, starting
at offset 32), then the function returns EFI_UNSUPPORTED at once.
This is bogus; this case should simply be treated as an OID
mismatch, and the loop should advance to the next Index value /
hash algorithm candidate. A remaining hash algo may have a shorter
OID and yield an OID match.
Signed-off-by: Doug Flick <[email protected]>
Namely:
(1) The TWO_BYTE_ENCODE check is independent of Index. If it evalutes
to TRUE for Index==0, then it will evaluate to TRUE for all other
Index values as well. As a result, the (Index == HASHALG_MAX)
condition will fire after the loop, and we'll return
EFI_UNSUPPORTED.
While this is correct, functionally speaking, it is wasteful to
keep re-checking TWO_BYTE_ENCODE in the loop body. The check
should be made at the top of the function, and EFI_UNSUPPORTED
should be returned at once, if appropriate.
(2) If the hash algorithm selected by Index has such a large OID that
the OID comparison cannot even be performed (because AuthDataSize
is not large enough for containing the OID in question, starting
at offset 32), then the function returns EFI_UNSUPPORTED at once.
This is bogus; this case should simply be treated as an OID
mismatch, and the loop should advance to the next Index value /
hash algorithm candidate. A remaining hash algo may have a shorter
OID and yield an OID match.
Signed-off-by: Doug Flick <[email protected]>
This commit updates the SecurityFixes.yaml file to include information about the CVE-2024-38797 vulnerability. Signed-off-by: Doug Flick <[email protected]>
Flickdm
force-pushed
the
security-advisory/cve-2024-38797/advisory
branch
from
7ef3efe to
519366f
Compare
1 of 3 tasks
1 of 3 tasks
hongxu-jia
added a commit
to hongxu-jia/openembedded-core
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 Signed-off-by: Hongxu Jia <[email protected]>
brainhoard-github
pushed a commit
to distro-core-curated-mirrors/poky-contrib
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: 3c77d61fc52eb1861ba68bfe916a71c987b9cd57) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Mathieu Dubois-Briand <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: c6d1f54942abd7a231cd33221eecc5620eda59fe) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to openembedded/openembedded-core
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 Signed-off-by: Hongxu Jia <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: c809f0fa07105343d21e1975d9e03cbcd7ba0fd4) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to openembedded/openembedded-core
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 Signed-off-by: Hongxu Jia <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to openembedded/openembedded-core
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 Signed-off-by: Hongxu Jia <[email protected]>
brainhoard-github
pushed a commit
to distro-core-curated-mirrors/poky-contrib
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: 866fc8ba96a72d3dd18838e6d8e77acb320a48d8) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Mathieu Dubois-Briand <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
brainhoard-github
pushed a commit
to distro-core-curated-mirrors/poky-contrib
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: 34c7941508d2bfc3ac271bdc6d5c0d1a652c2989) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Mathieu Dubois-Briand <[email protected]>
brainhoard-github
pushed a commit
to distro-core-curated-mirrors/poky-contrib
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: 34c7941508d2bfc3ac271bdc6d5c0d1a652c2989) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Mathieu Dubois-Briand <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: fe0257e5e93e4d744484ac46df4c322017874c64) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: 12f8445ef4f0e816a8ace86ac90d58069431615a) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to openembedded/openembedded-core
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 Signed-off-by: Hongxu Jia <[email protected]>
brainhoard-github
pushed a commit
to distro-core-curated-mirrors/poky-contrib
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: 34c7941508d2bfc3ac271bdc6d5c0d1a652c2989) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Mathieu Dubois-Briand <[email protected]>
halstead
pushed a commit
to yoctoproject/poky
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 (From OE-Core rev: a94550098d821e0055020a7d866648a761efcade) Signed-off-by: Hongxu Jia <[email protected]> Signed-off-by: Richard Purdie <[email protected]>
halstead
pushed a commit
to openembedded/openembedded-core
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 Signed-off-by: Hongxu Jia <[email protected]>
zboszor
pushed a commit
to zboszor/openembedded-core
that referenced
this pull request
According to [1]: EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability. Backport fixes from upstream edk2 [2][3] [1] https://nvd.nist.gov/vuln/detail/CVE-2024-38797 [2] GHSA-4wjw-6xmf-44xf [3] tianocore/edk2#10928 Signed-off-by: Hongxu Jia <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers1 more reviewerUh oh!
There was an error while loading. Please reload this page. AssigneesNo one assignedLabels
impact:security
ProjectsMilestoneNo milestoneDevelopmentSuccessfully merging this pull request may close these issues. Uh oh!
There was an error while loading. Please reload this page. 3 participantsAdd this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later. |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |