uefi-vars already tracks (and limits) the memory footprint of UEFI variables. Do that for variable policies too.
Fixes: CVE-2026-61405 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3890 Signed-off-by: Gerd Hoffmann <[email protected]> --- hw/uefi/var-service-policy.c | 5 +++++ hw/uefi/var-service-vars.c | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/hw/uefi/var-service-policy.c b/hw/uefi/var-service-policy.c index 0880bfe074a6..46c4ff2dacae 100644 --- a/hw/uefi/var-service-policy.c +++ b/hw/uefi/var-service-policy.c @@ -283,7 +283,12 @@ static uint32_t uefi_vars_mm_check_policy_register(uefi_vars_state *uv, return uefi_vars_mm_policy_error(mhdr, mchk, EFI_ALREADY_STARTED); } + if (uv->used_storage + pe->size > uv->max_storage) { + return uefi_vars_mm_policy_error(mhdr, mchk, EFI_OUT_OF_RESOURCES); + } + uefi_vars_add_policy(uv, pe); + uv->used_storage += pe->size; mchk->result = EFI_SUCCESS; return sizeof(*mchk); diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c index 2c83130ebf63..fd07782f1e0d 100644 --- a/hw/uefi/var-service-vars.c +++ b/hw/uefi/var-service-vars.c @@ -201,11 +201,15 @@ void uefi_vars_clear_all(uefi_vars_state *uv) void uefi_vars_update_storage(uefi_vars_state *uv) { uefi_variable *var; + uefi_var_policy *pol; uv->used_storage = 0; QTAILQ_FOREACH(var, &uv->variables, next) { uv->used_storage += variable_size(var); } + QTAILQ_FOREACH(pol, &uv->var_policies, next) { + uv->used_storage += pol->entry->size; + } } static gboolean check_access(uefi_vars_state *uv, uefi_variable *var) -- 2.55.0
