diff --git a/0001-MdeModulePkg-Core-Dxe-assert-SectionInstance-invaria.patch b/0001-MdeModulePkg-Core-Dxe-assert-SectionInstance-invaria.patch new file mode 100644 index 0000000000000000000000000000000000000000..1a36524ced0d718ff3d1f8d065e5bd8cacd8a4a9 --- /dev/null +++ b/0001-MdeModulePkg-Core-Dxe-assert-SectionInstance-invaria.patch @@ -0,0 +1,104 @@ +From b9bdfc72853fe97bd24401f8873ca61524dd2dc6 Mon Sep 17 00:00:00 2001 +From: Laszlo Ersek +Date: Thu, 19 Nov 2020 11:53:39 +0100 +Subject: [PATCH 1/2] MdeModulePkg/Core/Dxe: assert SectionInstance invariant + in FindChildNode() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FindChildNode() has two callers: GetSection(), and FindChildNode() itself. + +- At the GetSection() call site, a positive (i.e., nonzero) + SectionInstance is passed. This is because GetSection() takes a + zero-based (UINTN) SectionInstance, and then passes + Instance=(SectionInstance+1) to FindChildNode(). + +- For reaching the recursive FindChildNode() call site, a section type + mismatch, or a section instance mismatch, is necessary. This means, + respectively, that SectionInstance will either not have been decreased, + or not to zero anyway, at the recursive FindChildNode() call site. + +Add two ASSERT()s to FindChildNode(), for expressing the (SectionSize>0) +invariant. + +In turn, the invariant provides the explanation why, after the recursive +call, a zero SectionInstance implies success. Capture it in a comment. + +Cc: Dandan Bi +Cc: Hao A Wu +Cc: Jian J Wang +Cc: Liming Gao +Cc: Philippe Mathieu-Daudé +Signed-off-by: Laszlo Ersek +Reviewed-by: Liming Gao +Reviewed-by: Philippe Mathieu-Daudé +Message-Id: <20201119105340.16225-2-lersek@redhat.com> +--- + .../SectionExtraction/CoreSectionExtraction.c | 23 ++++++++++++++----- + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c b/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c +index d678166db4..d7f7ef4274 100644 +--- a/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c ++++ b/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c +@@ -952,8 +952,8 @@ CreateChildNode ( + search. + @param SearchType Indicates the type of section to search for. + @param SectionInstance Indicates which instance of section to find. +- This is an in/out parameter to deal with +- recursions. ++ This is an in/out parameter and it is 1-based, ++ to deal with recursions. + @param SectionDefinitionGuid Guid of section definition + @param FoundChild Output indicating the child node that is found. + @param FoundStream Output indicating which section stream the child +@@ -988,6 +988,8 @@ FindChildNode ( + EFI_STATUS ErrorStatus; + EFI_STATUS Status; + ++ ASSERT (*SectionInstance > 0); ++ + CurrentChildNode = NULL; + ErrorStatus = EFI_NOT_FOUND; + +@@ -1037,6 +1039,11 @@ FindChildNode ( + } + } + ++ // ++ // Type mismatch, or we haven't found the desired instance yet. ++ // ++ ASSERT (*SectionInstance > 0); ++ + if (CurrentChildNode->EncapsulatedStreamHandle != NULL_STREAM_HANDLE) { + // + // If the current node is an encapsulating node, recurse into it... +@@ -1050,16 +1057,20 @@ FindChildNode ( + &RecursedFoundStream, + AuthenticationStatus + ); +- // +- // If the status is not EFI_SUCCESS, just save the error code and continue +- // to find the request child node in the rest stream. +- // + if (*SectionInstance == 0) { ++ // ++ // The recursive FindChildNode() call decreased (*SectionInstance) to ++ // zero. ++ // + ASSERT_EFI_ERROR (Status); + *FoundChild = RecursedChildNode; + *FoundStream = RecursedFoundStream; + return EFI_SUCCESS; + } else { ++ // ++ // If the status is not EFI_SUCCESS, just save the error code and ++ // continue to find the request child node in the rest stream. ++ // + ErrorStatus = Status; + } + } else if ((CurrentChildNode->Type == EFI_SECTION_GUID_DEFINED) && (SearchType != EFI_SECTION_GUID_DEFINED)) { +-- +2.27.0 + diff --git a/0002-MdeModulePkg-Core-Dxe-limit-FwVol-encapsulation-sect.patch b/0002-MdeModulePkg-Core-Dxe-limit-FwVol-encapsulation-sect.patch new file mode 100644 index 0000000000000000000000000000000000000000..52becd00da0e193b78ab8e2bfe275a85c8ec47db --- /dev/null +++ b/0002-MdeModulePkg-Core-Dxe-limit-FwVol-encapsulation-sect.patch @@ -0,0 +1,199 @@ +From 47343af30435302c087027177613412a1a83e919 Mon Sep 17 00:00:00 2001 +From: Laszlo Ersek +Date: Thu, 19 Nov 2020 11:53:40 +0100 +Subject: [PATCH 2/2] MdeModulePkg/Core/Dxe: limit FwVol encapsulation section + recursion +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The DXE Core sets up a protocol notify function in its entry point, for +instances of the Firmware Volume Block2 Protocol: + + DxeMain() [DxeMain/DxeMain.c] + FwVolDriverInit() [FwVol/FwVol.c] + +Assume that a 3rd party UEFI driver or application installs an FVB +instance, with crafted contents. The notification function runs: + + NotifyFwVolBlock() [FwVol/FwVol.c] + +installing an instance of the Firmware Volume 2 Protocol on the handle. + +(Alternatively, assume that a 3rd party application calls +gDS->ProcessFirmwareVolume(), which may also produce a Firmware Volume 2 +Protocol instance.) + +The EFI_FIRMWARE_VOLUME2_PROTOCOL.ReadSection() member performs "a +depth-first, left-to-right search algorithm through all sections found in +the specified file" (quoting the PI spec), as follows: + + FvReadFileSection() [FwVol/FwVolRead.c] + GetSection() [SectionExtraction/CoreSectionExtraction.c] + FindChildNode() [SectionExtraction/CoreSectionExtraction.c] + FindChildNode() // recursive call + +FindChildNode() is called recursively for encapsulation sections. + +Currently this recursion is not limited. Introduce a new PCD +(fixed-at-build, or patchable-in-module), and make FindChildNode() track +the section nesting depth against that PCD. + +Cc: Dandan Bi +Cc: Hao A Wu +Cc: Jian J Wang +Cc: Liming Gao +Cc: Philippe Mathieu-Daudé +Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1743 +Signed-off-by: Laszlo Ersek +Reviewed-by: Liming Gao +Reviewed-by: Philippe Mathieu-Daudé +Message-Id: <20201119105340.16225-3-lersek@redhat.com> +--- + MdeModulePkg/Core/Dxe/DxeMain.inf | 1 + + .../SectionExtraction/CoreSectionExtraction.c | 33 +++++++++++++++++-- + MdeModulePkg/MdeModulePkg.dec | 6 ++++ + MdeModulePkg/MdeModulePkg.uni | 6 ++++ + 4 files changed, 44 insertions(+), 2 deletions(-) + +diff --git a/MdeModulePkg/Core/Dxe/DxeMain.inf b/MdeModulePkg/Core/Dxe/DxeMain.inf +index 1d4b11dc73..e4bca89577 100644 +--- a/MdeModulePkg/Core/Dxe/DxeMain.inf ++++ b/MdeModulePkg/Core/Dxe/DxeMain.inf +@@ -185,6 +185,7 @@ + gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType ## CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask ## CONSUMES + gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard ## CONSUMES ++ gEfiMdeModulePkgTokenSpaceGuid.PcdFwVolDxeMaxEncapsulationDepth ## CONSUMES + + # [Hob] + # RESOURCE_DESCRIPTOR ## CONSUMES +diff --git a/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c b/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c +index d7f7ef4274..908617d1ca 100644 +--- a/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c ++++ b/MdeModulePkg/Core/Dxe/SectionExtraction/CoreSectionExtraction.c +@@ -955,6 +955,9 @@ CreateChildNode ( + This is an in/out parameter and it is 1-based, + to deal with recursions. + @param SectionDefinitionGuid Guid of section definition ++ @param Depth Nesting depth of encapsulation sections. ++ Callers different from FindChildNode() are ++ responsible for passing in a zero Depth. + @param FoundChild Output indicating the child node that is found. + @param FoundStream Output indicating which section stream the child + was found in. If this stream was generated as a +@@ -968,6 +971,9 @@ CreateChildNode ( + @retval EFI_NOT_FOUND Requested child node does not exist. + @retval EFI_PROTOCOL_ERROR a required GUIDED section extraction protocol + does not exist ++ @retval EFI_ABORTED Recursion aborted because Depth has been ++ greater than or equal to ++ PcdFwVolDxeMaxEncapsulationDepth. + + **/ + EFI_STATUS +@@ -976,6 +982,7 @@ FindChildNode ( + IN EFI_SECTION_TYPE SearchType, + IN OUT UINTN *SectionInstance, + IN EFI_GUID *SectionDefinitionGuid, ++ IN UINT32 Depth, + OUT CORE_SECTION_CHILD_NODE **FoundChild, + OUT CORE_SECTION_STREAM_NODE **FoundStream, + OUT UINT32 *AuthenticationStatus +@@ -990,6 +997,10 @@ FindChildNode ( + + ASSERT (*SectionInstance > 0); + ++ if (Depth >= PcdGet32 (PcdFwVolDxeMaxEncapsulationDepth)) { ++ return EFI_ABORTED; ++ } ++ + CurrentChildNode = NULL; + ErrorStatus = EFI_NOT_FOUND; + +@@ -1053,6 +1064,7 @@ FindChildNode ( + SearchType, + SectionInstance, + SectionDefinitionGuid, ++ Depth + 1, + &RecursedChildNode, + &RecursedFoundStream, + AuthenticationStatus +@@ -1067,9 +1079,17 @@ FindChildNode ( + *FoundStream = RecursedFoundStream; + return EFI_SUCCESS; + } else { ++ if (Status == EFI_ABORTED) { ++ // ++ // If the recursive call was aborted due to nesting depth, stop ++ // looking for the requested child node. The skipped subtree could ++ // throw off the instance counting. ++ // ++ return Status; ++ } + // +- // If the status is not EFI_SUCCESS, just save the error code and +- // continue to find the request child node in the rest stream. ++ // Save the error code and continue to find the requested child node in ++ // the rest of the stream. + // + ErrorStatus = Status; + } +@@ -1272,11 +1292,20 @@ GetSection ( + *SectionType, + &Instance, + SectionDefinitionGuid, ++ 0, // encapsulation depth + &ChildNode, + &ChildStreamNode, + &ExtractedAuthenticationStatus + ); + if (EFI_ERROR (Status)) { ++ if (Status == EFI_ABORTED) { ++ DEBUG ((DEBUG_ERROR, "%a: recursion aborted due to nesting depth\n", ++ __FUNCTION__)); ++ // ++ // Map "aborted" to "not found". ++ // ++ Status = EFI_NOT_FOUND; ++ } + goto GetSection_Done; + } + +diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec +index 0007552819..9b52b34494 100644 +--- a/MdeModulePkg/MdeModulePkg.dec ++++ b/MdeModulePkg/MdeModulePkg.dec +@@ -1529,6 +1529,12 @@ + # @Prompt Enable Capsule On Disk support. + gEfiMdeModulePkgTokenSpaceGuid.PcdCapsuleOnDiskSupport|FALSE|BOOLEAN|0x0000002d + ++ ## Maximum permitted encapsulation levels of sections in a firmware volume, ++ # in the DXE phase. Minimum value is 1. Sections nested more deeply are ++ # rejected. ++ # @Prompt Maximum permitted FwVol section nesting depth (exclusive). ++ gEfiMdeModulePkgTokenSpaceGuid.PcdFwVolDxeMaxEncapsulationDepth|0x10|UINT32|0x00000030 ++ + [PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx] + ## This PCD defines the Console output row. The default value is 25 according to UEFI spec. + # This PCD could be set to 0 then console output would be at max column and max row. +diff --git a/MdeModulePkg/MdeModulePkg.uni b/MdeModulePkg/MdeModulePkg.uni +index 40884c57a4..1b347a75f6 100644 +--- a/MdeModulePkg/MdeModulePkg.uni ++++ b/MdeModulePkg/MdeModulePkg.uni +@@ -1160,6 +1160,12 @@ + "Note:
" + "If Both Capsule In Ram and Capsule On Disk are provisioned at the same time, the Capsule On Disk will be bypassed." + ++#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdFwVolDxeMaxEncapsulationDepth_PROMPT #language en-US "Maximum permitted FwVol section nesting depth (exclusive)." ++ ++#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdFwVolDxeMaxEncapsulationDepth_HELP #language en-US "Maximum permitted encapsulation levels of sections in a firmware volume,
" ++ "in the DXE phase. Minimum value is 1. Sections nested more deeply are
" ++ "rejected." ++ + #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdCapsuleInRamSupport_PROMPT #language en-US "Enable Capsule In Ram support" + + #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdCapsuleInRamSupport_HELP #language en-US "Capsule In Ram is to use memory to deliver the capsules that will be processed after system reset.

" +-- +2.27.0 + diff --git a/edk2.spec b/edk2.spec index 32f9399e04b294f3d410f247673d87797d69bc31..cec9798e77a62a2ee3d61fa7cf77e0436e6ac43d 100644 --- a/edk2.spec +++ b/edk2.spec @@ -5,7 +5,7 @@ Name: edk2 Version: %{stable_date} -Release: 3 +Release: 4 Summary: EFI Development Kit II License: BSD-2-Clause-Patent URL: https://github.com/tianocore/edk2 @@ -17,6 +17,8 @@ Patch0002: 0002-CryptoPkg-Upgrade-OpenSSL-to-1.1.1f.patch Patch0003: 0001-SecurityPkg-DxeImageVerificationLib-extract-SecDataD.patch Patch0004: 0002-SecurityPkg-DxeImageVerificationLib-assign-WinCertif.patch Patch0005: 0003-SecurityPkg-DxeImageVerificationLib-catch-alignment-.patch +Patch0006: 0001-MdeModulePkg-Core-Dxe-assert-SectionInstance-invaria.patch +Patch0007: 0002-MdeModulePkg-Core-Dxe-limit-FwVol-encapsulation-sect.patch BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python2 @@ -212,11 +214,14 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys %endif %changelog +* Mon Jun 28 2021 openEuler Buildteam - 202002-4 +- fix CVE-2021-28210 + * Mon May 10 2021 openEuler Buildteam - 202002-3 - Fix CVE-2019-14562 * Wed Oct 14 2020 zhangxinhao - 202002-2 -- add build option "-D SECURE_BOOT_ENABLE=TRUE" to enable secure boot +- add build option "-D SECURE_BOOT_ENABLE=TRUE" to enable secure boot * Thu May 7 2020 openEuler Buildteam - 202002-1 - Update edk2 to stable202002 and OpenSSL to 1.1.1f