From 5524bf2a2a93ba28e37f9975f48f94e014cf6974 Mon Sep 17 00:00:00 2001 From: TL <1045523086@qq.com> Date: Wed, 15 Oct 2025 20:40:56 +0800 Subject: [PATCH] fix CVE-2025-9230 --- ...ix-incorrect-check-of-unwrapped-key-.patch | 31 +++++++++++++++++++ edk2.spec | 8 ++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 0093-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch diff --git a/0093-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch b/0093-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch new file mode 100644 index 0000000..1a42879 --- /dev/null +++ b/0093-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch @@ -0,0 +1,31 @@ +From 02fb52822b45ac385a964a44335b9c6933d6d9a9 Mon Sep 17 00:00:00 2001 +From: TL <1045523086@qq.com> +Date: Wed, 15 Oct 2025 12:05:39 +0800 +Subject: [PATCH] kek_unwrap_key(): Fix incorrect check of unwrapped key size + +Fix CVE-2025-9230 + +The check is off by 8 bytes so it is possible to overread by +up to 8 bytes and overwrite up to 4 bytes. + +Origin: https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45 +--- + CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c +index 2373092b..6b507c3f 100644 +--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c ++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c +@@ -228,7 +228,7 @@ static int kek_unwrap_key(unsigned char *out, size_t *outlen, + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } +-- +2.43.0 + diff --git a/edk2.spec b/edk2.spec index af9ce91..3614498 100644 --- a/edk2.spec +++ b/edk2.spec @@ -7,7 +7,7 @@ Name: edk2 Version: %{stable_date} -Release: 25 +Release: 26 Summary: EFI Development Kit II License: BSD-2-Clause-Patent and OpenSSL and MIT URL: https://github.com/tianocore/edk2 @@ -154,6 +154,9 @@ patch90: 0090-fix-build-error-for-edk2-on-loongarch64.patch patch91: 0091-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch patch92: 0092-UefiCpuPkg-PiSmmCpuDxeSmm-Safe-handling-of-IDT-regis.patch +# Fix CVE-2025-9230 +patch93: 0093-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch + BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python3-unversioned-command isl %description @@ -423,6 +426,9 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys %endif %changelog +* Wed Oct 15 2025 taolinghongfei - 202308-26 +- fix CVE-2025-9230 + * Mon Sep 29 2025 taolinghongfei - 202308-25 - fix CVE-2024-38805, CVE-2025-3770 -- Gitee