From 9a7cacf83c8597d21724edf0f2fcd5b6c13fb32e Mon Sep 17 00:00:00 2001 From: ShenYage Date: Tue, 11 Jun 2024 15:11:37 +0800 Subject: [PATCH] Fix CVE-2024-1298 Signed-off-by: ShenYage (cherry picked from commit e442c48e58d42e4ba006dbe2d86b401214b70cac) --- ...ential-UINT32-overflow-in-S3-ResumeC.patch | 47 +++++++++++++++++++ edk2.spec | 7 ++- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 0046-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch diff --git a/0046-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch b/0046-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch new file mode 100644 index 0000000..b876fad --- /dev/null +++ b/0046-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch @@ -0,0 +1,47 @@ +From 413fa91e9a7d28732c55589a7705ae68ec824494 Mon Sep 17 00:00:00 2001 +From: ShenYage +Date: Tue, 11 Jun 2024 14:57:58 +0800 +Subject: [PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount + +REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677 + +Attacker able to modify physical memory and ResumeCount. +System will crash/DoS when ResumeCount reaches its MAX_UINT32. + +Cc: Zhiguang Liu +Cc: Dandan Bi +Cc: Liming Gao + +Signed-off-by: Pakkirisamy ShanmugavelX +Reviewed-by: Liming Gao +--- + .../FirmwarePerformancePei.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c +index 2f2b2a8..2ba9215 100644 +--- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c ++++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c +@@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei ( + // + S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, AcpiS3ResumeRecord->ResumeCount); + AcpiS3ResumeRecord->ResumeCount++; +- AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); ++ if (AcpiS3ResumeRecord->ResumeCount > 0) { ++ AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); ++ DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance - AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume)); ++ } else { ++ DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the MAX_UINT32 value. S3 ResumeCount record reset to Zero.")); ++ } + +- DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount = %d\n", AcpiS3ResumeRecord->ResumeCount)); +- DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume = %ld\n", AcpiS3ResumeRecord->FullResume)); +- DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume = %ld\n", AcpiS3ResumeRecord->AverageResume)); ++ DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount = 0x%x\n", AcpiS3ResumeRecord->ResumeCount)); ++ DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume = 0x%x\n", AcpiS3ResumeRecord->FullResume)); + + // + // Update S3 Suspend Performance Record. +-- +2.33.0 + diff --git a/edk2.spec b/edk2.spec index 95162a5..cefed7a 100644 --- a/edk2.spec +++ b/edk2.spec @@ -7,7 +7,7 @@ Name: edk2 Version: %{stable_date} -Release: 6 +Release: 7 Summary: EFI Development Kit II License: BSD-2-Clause-Patent and OpenSSL and MIT URL: https://github.com/tianocore/edk2 @@ -69,6 +69,8 @@ patch43: 0043-Hardening-around-not_resumable-sessions.patch patch44: 0044-Add-a-test-for-session-cache-overflow.patch patch45: 0045-Limit-the-execution-time-of-RSA-public-key-check.patch +# Fix CVE-2024-1298 +patch46: 0046-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python3-unversioned-command isl %description @@ -305,6 +307,9 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys %endif %changelog +* Tue Jun 11 2024 shenyage - 202308-7 +- fix CVE-2024-1298 + * Mon Apr 15 2024 shenyage - 202308-6 - fix CVE-2023-6237、CVE-2024-2511 -- Gitee