From: Gerd Hoffmann <[email protected]> This is read-only variable which informs the OS about the secure boot state. Reject any attempts to write to it.
Fixes: CVE-2026-16288 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4039 Acked-by: Luigi Leonardi <[email protected]> Signed-off-by: Gerd Hoffmann <[email protected]> Message-ID: <[email protected]> (cherry picked from commit bd9b3c50f458ce24fee084916cf0eba58bd9a33b) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c index f3dc9c6ca60..899444af12d 100644 --- a/hw/uefi/var-service-auth.c +++ b/hw/uefi/var-service-auth.c @@ -298,6 +298,13 @@ efi_status uefi_vars_check_secure_boot(uefi_vars_state *uv, uefi_variable *var) return EFI_WRITE_PROTECTED; } + /* reject SetupMode updates */ + if (qemu_uuid_is_equal(&var->guid, &EfiGlobalVariable) && + uefi_str_equal(var->name, var->name_size, + name_setup_mode, sizeof(name_setup_mode))) { + return EFI_WRITE_PROTECTED; + } + return EFI_SUCCESS; } -- 2.47.3
