Skip to content

Commit

Permalink
EmbeddedPkg/Hob: Integer Overflow in CreateHob()
Browse files Browse the repository at this point in the history
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166

Fix integer overflow in various CreateHob instances.
Fixes: CVE-2022-36765

The CreateHob() function aligns the requested size to 8
performing the following operation:
```
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
```

No checks are performed to ensure this value doesn't
overflow, and could lead to CreateHob() returning a smaller
HOB than requested, which could lead to OOB HOB accesses.

Reported-by: Marc Beatove <[email protected]>
Cc: Leif Lindholm <[email protected]>
Reviewed-by: Ard Biesheuvel <[email protected]>
Cc: Abner Chang <[email protected]>
Cc: John Mathew <[email protected]>
Authored-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Gua Guo <[email protected]>
  • Loading branch information
gguo11837463 authored and mergify[bot] committed Jan 26, 2024
1 parent 049695a commit aeaee89
Showing 1 changed file with 43 additions and 0 deletions.
43 changes: 43 additions & 0 deletions EmbeddedPkg/Library/PrePiHobLib/Hob.c
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,13 @@ CreateHob (

HandOffHob = GetHobList ();

//
// Check Length to avoid data overflow.
//
if (HobLength > MAX_UINT16 - 0x7) {
return NULL;
}

HobLength = (UINT16)((HobLength + 0x7) & (~0x7));

FreeMemory = HandOffHob->EfiFreeMemoryTop - HandOffHob->EfiFreeMemoryBottom;
Expand Down Expand Up @@ -160,6 +167,9 @@ BuildResourceDescriptorHob (

Hob = CreateHob (EFI_HOB_TYPE_RESOURCE_DESCRIPTOR, sizeof (EFI_HOB_RESOURCE_DESCRIPTOR));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

Hob->ResourceType = ResourceType;
Hob->ResourceAttribute = ResourceAttribute;
Expand Down Expand Up @@ -401,6 +411,10 @@ BuildModuleHob (
);

Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_MODULE));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

CopyGuid (&(Hob->MemoryAllocationHeader.Name), &gEfiHobMemoryAllocModuleGuid);
Hob->MemoryAllocationHeader.MemoryBaseAddress = MemoryAllocationModule;
Expand Down Expand Up @@ -449,6 +463,11 @@ BuildGuidHob (
ASSERT (DataLength <= (0xffff - sizeof (EFI_HOB_GUID_TYPE)));

Hob = CreateHob (EFI_HOB_TYPE_GUID_EXTENSION, (UINT16)(sizeof (EFI_HOB_GUID_TYPE) + DataLength));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return NULL;
}

CopyGuid (&Hob->Name, Guid);
return Hob + 1;
}
Expand Down Expand Up @@ -512,6 +531,10 @@ BuildFvHob (
EFI_HOB_FIRMWARE_VOLUME *Hob;

Hob = CreateHob (EFI_HOB_TYPE_FV, sizeof (EFI_HOB_FIRMWARE_VOLUME));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

Hob->BaseAddress = BaseAddress;
Hob->Length = Length;
Expand Down Expand Up @@ -543,6 +566,10 @@ BuildFv2Hob (
EFI_HOB_FIRMWARE_VOLUME2 *Hob;

Hob = CreateHob (EFI_HOB_TYPE_FV2, sizeof (EFI_HOB_FIRMWARE_VOLUME2));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

Hob->BaseAddress = BaseAddress;
Hob->Length = Length;
Expand Down Expand Up @@ -584,6 +611,10 @@ BuildFv3Hob (
EFI_HOB_FIRMWARE_VOLUME3 *Hob;

Hob = CreateHob (EFI_HOB_TYPE_FV3, sizeof (EFI_HOB_FIRMWARE_VOLUME3));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

Hob->BaseAddress = BaseAddress;
Hob->Length = Length;
Expand Down Expand Up @@ -639,6 +670,10 @@ BuildCpuHob (
EFI_HOB_CPU *Hob;

Hob = CreateHob (EFI_HOB_TYPE_CPU, sizeof (EFI_HOB_CPU));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

Hob->SizeOfMemorySpace = SizeOfMemorySpace;
Hob->SizeOfIoSpace = SizeOfIoSpace;
Expand Down Expand Up @@ -676,6 +711,10 @@ BuildStackHob (
);

Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION_STACK));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

CopyGuid (&(Hob->AllocDescriptor.Name), &gEfiHobMemoryAllocStackGuid);
Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
Expand Down Expand Up @@ -756,6 +795,10 @@ BuildMemoryAllocationHob (
);

Hob = CreateHob (EFI_HOB_TYPE_MEMORY_ALLOCATION, sizeof (EFI_HOB_MEMORY_ALLOCATION));
ASSERT (Hob != NULL);
if (Hob == NULL) {
return;
}

ZeroMem (&(Hob->AllocDescriptor.Name), sizeof (EFI_GUID));
Hob->AllocDescriptor.MemoryBaseAddress = BaseAddress;
Expand Down

0 comments on commit aeaee89

Please sign in to comment.