Description

The GetRandomNumber functions in DxeRngLib can return success without actually generating a random number. This occurs because there is a code path through GenerateRandomNumberViaNist800Algorithm that does not update the output buffer and does not initialize the Status variable.

• Assume mFirstAlgo == MAX_UINTN (no secure algorithms available)
• Assume none of the secure algorithms have Available set.
• Assume PcdEnforceSecureRngAlgorithms is TRUE.

In this condition, the Status variable is never initialized, Buffer data is never touched. It is fairly likely that Status is 0, so we can return EFI_SUCCESS without writing anything to Buffer.

Fix is to set Status = error_code in this code path. EFI_SECURITY_VIOLATION seems appropriate.

• Breaking change?
  • Breaking change - Does this PR cause a break in build or boot behavior?
  • Examples: Does it add a new library class or move a module to a different repo.
• Impacts security?
  • Security - Does this PR have a direct security impact?
  • Examples: Crypto algorithm change or buffer overflow fix.
• Includes tests?
  • Tests - Does this PR include any explicit test code?
  • Examples: Unit tests or integration tests.

How This Was Tested

• Observed EFI_SUCCESS returned from GetRandomNumber16 even though output value remained 0.
• Applied fix.
• Observed EFI_SECURITY_VIOLATION returned from GetRandomNumber16 when expected.
• Set PcdEnforceSecureRngAlgorithms to false, observed successful RNG generation.

Integration Instructions

N/A