From 5b63295e9dd56c02d585f030a2efaa9dedf8f303 Mon Sep 17 00:00:00 2001 From: ShenYage Date: Tue, 11 Jun 2024 17:53:20 +0800 Subject: [PATCH] Fix CVE-2024-1298 Signed-off-by: ShenYage --- ...ential-UINT32-overflow-in-S3-ResumeC.patch | 47 +++++++++++++++++++ edk2.spec | 6 ++- 2 files changed, 52 insertions(+), 1 deletion(-) create mode 100644 0088-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch diff --git a/0088-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch b/0088-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch new file mode 100644 index 0000000..2713749 --- /dev/null +++ b/0088-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch @@ -0,0 +1,47 @@ +From c65a8a1641b91575d20d4afd5cdd83e977c715a7 Mon Sep 17 00:00:00 2001 +From: ShenYage +Date: Tue, 11 Jun 2024 17:02:24 +0800 +Subject: [PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount + +REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677 + +Attacker able to modify physical memory and ResumeCount. +System will crash/DoS when ResumeCount reaches its MAX_UINT32. + +Cc: Zhiguang Liu +Cc: Dandan Bi +Cc: Liming Gao + +Signed-off-by: Pakkirisamy ShanmugavelX +Reviewed-by: Liming Gao +--- + .../FirmwarePerformancePei.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c +index 493d09c..bfd8d5f 100644 +--- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c ++++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c +@@ -110,11 +110,15 @@ FpdtStatusCodeListenerPei ( + // + S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, AcpiS3ResumeRecord->ResumeCount); + AcpiS3ResumeRecord->ResumeCount++; +- AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); ++ if (AcpiS3ResumeRecord->ResumeCount > 0) { ++ AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); ++ DEBUG ((EFI_D_INFO, "\nFPDT: S3 Resume Performance - AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume)); ++ } else { ++ DEBUG ((EFI_D_ERROR, "\nFPDT: S3 ResumeCount reaches the MAX_UINT32 value. S3 ResumeCount record reset to Zero.")); ++ } + +- DEBUG ((EFI_D_INFO, "FPDT: S3 Resume Performance - ResumeCount = %d\n", AcpiS3ResumeRecord->ResumeCount)); +- DEBUG ((EFI_D_INFO, "FPDT: S3 Resume Performance - FullResume = %ld\n", AcpiS3ResumeRecord->FullResume)); +- DEBUG ((EFI_D_INFO, "FPDT: S3 Resume Performance - AverageResume = %ld\n", AcpiS3ResumeRecord->AverageResume)); ++ DEBUG ((EFI_D_INFO, "FPDT: S3 Resume Performance - ResumeCount = 0x%x\n", AcpiS3ResumeRecord->ResumeCount)); ++ DEBUG ((EFI_D_INFO, "FPDT: S3 Resume Performance - FullResume = 0x%x\n", AcpiS3ResumeRecord->FullResume)); + + // + // Update S3 Suspend Performance Record. +-- +2.33.0 + diff --git a/edk2.spec b/edk2.spec index ffc18c6..91668d6 100644 --- a/edk2.spec +++ b/edk2.spec @@ -5,7 +5,7 @@ Name: edk2 Version: %{stable_date} -Release: 21 +Release: 22 Summary: EFI Development Kit II License: BSD-2-Clause-Patent URL: https://github.com/tianocore/edk2 @@ -103,6 +103,7 @@ Patch0087: 0085-Extend-the-multi_resume-test-for-simultaneous-resump.patch Patch0088: 0086-Hardening-around-not_resumable-sessions.patch Patch0089: 0087-Add-a-test-for-session-cache-overflow.patch +Patch0090: 0088-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python2 %description @@ -297,6 +298,9 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys %endif %changelog +* Tue Jun 11 2024 shenyage - 202002-22 +- fix CVE-2024-1298 + * Thu Apr 18 2024 Jiabo Feng - 202002-21 - update release. commit(2723c0159f0f84e2169b124dca9f4eb0dc6863f9) has been merged into commit(a8c3711f01ae9a152f0e8cede2547b4c54712400) -- Gitee