Hi Gerd,
On 2/7/26 11:23, Gerd Hoffmann wrote:
This was never meant to be active in production builds. It's a code
path not hit on a normal boot (OVMF wouldn't try variable updates which
are not allowed), so this went unnoticed.
Wrap the call into "if (VARIABLE_POLICY_DEBUG)" so it is never used
unless the #define is changed to true.
Also fix the name printing to not overrun the entry size.
Fixes: CVE-2026-58582
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3615
Signed-off-by: Gerd Hoffmann <[email protected]>
---
hw/uefi/var-service-policy.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c
index 989bf87ddb86..b56fc62f7092 100644
--- a/hw/uefi/var-service-policy.c
+++ b/hw/uefi/var-service-policy.c
@@ -16,6 +16,8 @@
#include "trace.h"
+#define VARIABLE_POLICY_DEBUG 0
To avoid this anti-pattern, ...
static void calc_policy(uefi_var_policy *pol);
static int uefi_var_policy_post_load(void *opaque, int version_id)
@@ -40,11 +42,12 @@ const VMStateDescription vmstate_uefi_var_policy = {
static void print_policy_entry(variable_policy_entry *pe)
{
uint16_t *name = (void *)pe + pe->offset_to_name;
+ uint16_t *end = (void *)pe + pe->size;
fprintf(stderr, "%s:\n", __func__);
fprintf(stderr, " name ´");
- while (*name) {
+ while (*name && name < end) {
fprintf(stderr, "%c", *name);
name++;
}
@@ -173,7 +176,9 @@ efi_status uefi_vars_policy_check(uefi_vars_state *uv,
pe = pol->entry;
uefi_trace_variable(__func__, var->guid, var->name, var->name_size);
... better keep it compiled with a trace event:
if (trace_event_get_state_backends(TRACE_UEFI_POLICY)) {
- print_policy_entry(pe);
+ if (VARIABLE_POLICY_DEBUG) {
+ print_policy_entry(pe);
+ }
if ((var->attributes & pe->attributes_must_have) != pe->attributes_must_have) {
trace_uefi_vars_policy_deny("must-have-attr");
