Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: aeaee8944f0eaacbf4cdf39279785b9ba4836bb6
https://github.com/tianocore/edk2/commit/aeaee8944f0eaacbf4cdf39279785b9ba4836bb6
Author: Gua Guo <[email protected]>
Date: 2024-01-26 (Fri, 26 Jan 2024)
Changed paths:
M EmbeddedPkg/Library/PrePiHobLib/Hob.c
Log Message:
-----------
EmbeddedPkg/Hob: Integer Overflow in CreateHob()
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
Fix integer overflow in various CreateHob instances.
Fixes: CVE-2022-36765
The CreateHob() function aligns the requested size to 8
performing the following operation:
```
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
```
No checks are performed to ensure this value doesn't
overflow, and could lead to CreateHob() returning a smaller
HOB than requested, which could lead to OOB HOB accesses.
Reported-by: Marc Beatove <[email protected]>
Cc: Leif Lindholm <[email protected]>
Reviewed-by: Ard Biesheuvel <[email protected]>
Cc: Abner Chang <[email protected]>
Cc: John Mathew <[email protected]>
Authored-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Gua Guo <[email protected]>
Commit: 9a75b030cf27d2530444e9a2f9f11867f79bf679
https://github.com/tianocore/edk2/commit/9a75b030cf27d2530444e9a2f9f11867f79bf679
Author: Gua Guo <[email protected]>
Date: 2024-01-26 (Fri, 26 Jan 2024)
Changed paths:
M
StandaloneMmPkg/Library/StandaloneMmCoreHobLib/Arm/StandaloneMmCoreHobLib.c
Log Message:
-----------
StandaloneMmPkg/Hob: Integer Overflow in CreateHob()
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
Fix integer overflow in various CreateHob instances.
Fixes: CVE-2022-36765
The CreateHob() function aligns the requested size to 8
performing the following operation:
```
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
```
No checks are performed to ensure this value doesn't
overflow, and could lead to CreateHob() returning a smaller
HOB than requested, which could lead to OOB HOB accesses.
Reported-by: Marc Beatove <[email protected]>
Reviewed-by: Ard Biesheuvel <[email protected]>
Cc: Sami Mujawar <[email protected]>
Reviewed-by: Ray Ni <[email protected]>
Cc: John Mathew <[email protected]>
Authored-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Gua Guo <[email protected]>
Compare: https://github.com/tianocore/edk2/compare/049695a0b1e2...9a75b030cf27
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
