Reviewed-by: Liming Gao <[email protected]> This is a security fix. So, I think it should catch this stable tag 202405
Thanks Liming > -----邮件原件----- > 发件人: [email protected] <[email protected]> 代表 Pakkirisamy > ShanmugavelX > 发送时间: 2024年5月6日 17:53 > 收件人: [email protected] > 抄送: Shanmugavel Pakkirisamy <[email protected]>; > Zhiguang Liu <[email protected]>; Dandan Bi <[email protected]>; > Liming Gao <[email protected]> > 主题: [edk2-devel] [PATCH] MdeModulePkg: Potential UINT32 overflow in S3 > ResumeCount > > From: Shanmugavel Pakkirisamy <[email protected]> > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677 > > Attacker able to modify physical memory and ResumeCount. > System will crash/DoS when ResumeCount reaches its MAX_UINT32. > > Cc: Zhiguang Liu <[email protected]> > Cc: Dandan Bi <[email protected]> > Cc: Liming Gao <[email protected]> > > Signed-off-by: Pakkirisamy ShanmugavelX > <[email protected]> > --- > > MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePe > rformancePei.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > > diff --git > a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware > PerformancePei.c > b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware > PerformancePei.c > index 2f2b2a80b2..1035ed8640 100644 > --- > a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware > PerformancePei.c > +++ > b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/Firmware > PerformancePei.c > @@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei ( > // > S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, > AcpiS3ResumeRecord->ResumeCount); > AcpiS3ResumeRecord->ResumeCount++; > - AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + > AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); > - > - DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount > = %d\n", AcpiS3ResumeRecord->ResumeCount)); > - DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume > = %ld\n", AcpiS3ResumeRecord->FullResume)); > - DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume > = %ld\n", AcpiS3ResumeRecord->AverageResume)); > + if (AcpiS3ResumeRecord->ResumeCount > 0) { > + AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + > AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount); > + DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance - > AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume)); > + } > + else { > + DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the > MAX_UINT32 value. S3 ResumeCount record reset to Zero.")); > + } > + DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount = > 0x%x\n", AcpiS3ResumeRecord->ResumeCount)); > + DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume = > 0x%x\n", AcpiS3ResumeRecord->FullResume)); > > // > // Update S3 Suspend Performance Record. > -- > 2.45.0.windows.1 > > > > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118745): https://edk2.groups.io/g/devel/message/118745 Mute This Topic: https://groups.io/mt/105997183/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
