mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-19 09:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

ovmf: fix CVE-2024-38796

Browse Source 
Backport a fix from upstream to resolve CVE-2024-38796

    c95233b852

(From OE-Core rev: c3d1be52b4dc18e6980bf6c3f2e2cb7fba9f986e)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Hongxu Jia
2024-11-22 17:46:15 +08:00
committed by Steve Sakoman
parent e8a9aac72d
commit f11c3027f4
2 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
meta/recipes-core/ovmf/ovmf/0001-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch Normal file
View File

@@ -0,0 +1,37 @@
From c4d6af8428375c0343fcfd20bf1465e6d4be4690 Mon Sep 17 00:00:00 2001
From: Doug Flick <dougflick@microsoft.com>
Date: Fri, 22 Nov 2024 17:44:27 +0800
Subject: [PATCH] MdePkg: Fix overflow issue in BasePeCoffLib
The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is
also a UINT32 value. The current code does not check for overflow when
adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a
check to ensure that the addition does not overflow.
Signed-off-by: Doug Flick <dougflick@microsoft.com>
Authored-by: sriraamx gobichettipalayam <sri..@intel.com>
CVE: CVE-2024-38796
Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/c95233b8525ca6828921affd1496146cff262e65]
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
---
MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
index 6d8d9faeb8..2339b111b5 100644
--- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
+++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
@@ -1014,7 +1014,7 @@ PeCoffLoaderRelocateImage (
RelocDir = &Hdr.Te->DataDirectory[0];
}
- if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
+ if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
ImageContext,
--
2.34.1

1
meta/recipes-core/ovmf/ovmf_git.bb
View File

@@ -53,6 +53,7 @@ SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \
file://CVE-2022-36765-0001.patch \ file://CVE-2022-36765-0001.patch \
file://CVE-2022-36765-0002.patch \ file://CVE-2022-36765-0002.patch \
file://CVE-2022-36765-0003.patch \ file://CVE-2022-36765-0003.patch \
file://0001-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch \
" "
PV = "edk2-stable202202" PV = "edk2-stable202202"