From 28ca1b222f4911797b5466f9afb378c6acc04795 Mon Sep 17 00:00:00 2001 From: TL <1045523086@qq.com> Date: Wed, 15 Oct 2025 21:00:45 +0800 Subject: [PATCH] fix CVE-2025-9230 --- ...ix-incorrect-check-of-unwrapped-key-.patch | 31 +++++++++++++++++++ edk2.spec | 8 ++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 0118-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch diff --git a/0118-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch b/0118-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch new file mode 100644 index 0000000..1a42879 --- /dev/null +++ b/0118-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch @@ -0,0 +1,31 @@ +From 02fb52822b45ac385a964a44335b9c6933d6d9a9 Mon Sep 17 00:00:00 2001 +From: TL <1045523086@qq.com> +Date: Wed, 15 Oct 2025 12:05:39 +0800 +Subject: [PATCH] kek_unwrap_key(): Fix incorrect check of unwrapped key size + +Fix CVE-2025-9230 + +The check is off by 8 bytes so it is possible to overread by +up to 8 bytes and overwrite up to 4 bytes. + +Origin: https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45 +--- + CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c +index 2373092b..6b507c3f 100644 +--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c ++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/cms/cms_pwri.c +@@ -228,7 +228,7 @@ static int kek_unwrap_key(unsigned char *out, size_t *outlen, + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } +-- +2.43.0 + diff --git a/edk2.spec b/edk2.spec index 00eea20..8fecfb0 100644 --- a/edk2.spec +++ b/edk2.spec @@ -7,7 +7,7 @@ Name: edk2 Version: %{stable_date} -Release: 26 +Release: 27 Summary: EFI Development Kit II License: BSD-2-Clause-Patent and OpenSSL and MIT URL: https://github.com/tianocore/edk2 @@ -188,6 +188,9 @@ patch115: 0115-OvmfPkg-AmdSev-Integrate-grub2-x86_64-efi-modules-fr.patch patch116: 0116-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch patch117: 0117-UefiCpuPkg-PiSmmCpuDxeSmm-Safe-handling-of-IDT-regis.patch +# Fix CVE-2025-9230 +patch118: 0118-kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-.patch + BuildRequires: acpica-tools gcc gcc-c++ libuuid-devel python3 bc nasm python3-unversioned-command isl %ifarch x86_64 @@ -499,6 +502,9 @@ chmod +x %{buildroot}%{_bindir}/Rsa2048Sha256GenerateKeys %endif %changelog +* Wed Oct 15 2025 taolinghongfei - 202308-27 +- fix CVE-2025-9230 + * Fri Sep 26 2025 taolinghongfei - 202308-26 - fix CVE-2024-38805, CVE-2025-3370 -- Gitee