U-Boot takes the offsets and sizes of a PE/COFF image from its headers and uses them before it knows whether the image may run. With Secure Boot on, efi_load_pe() authenticates the image first but goes on copying and relocating it when authentication fails, and only then returns EFI_SECURITY_VIOLATION; efi_image_parse(), which collects the regions to hash, runs before the signature is checked, and so does the walk of the certificate table. TCG2 measured boot parses every image as well. So an image that will be refused, or one that is only measured, can make U-Boot read or write outside its buffers, or hang.
This series checks those fields against the image where they are read, along the lines of EDK2's PeCoffLoaderLib and DxeImageVerificationLib: - patch 1 has efi_check_pe() check for a 64bit NT header again, as its comment says; - patch 2 checks the headers, the sections and the certificate table in efi_image_parse(), and fails on errors of efi_image_region_add(); - patches 3-5 have efi_load_pe() reject, before allocating the image, a section whose end wraps around, section data past the end of the file and headers that do not fit into the image; - patch 6 checks the relocation table against the image; - patch 7 rejects a certificate table holding a certificate shorter than its header, which made the walk loop forever, or longer than the rest of the table; - patch 8 refuses to load an image whose TCG2 measurement failed, as EDK2 does, instead of starting it unmeasured; - patches 9 and 10 add unit tests and a Secure Boot test. barebox, whose EFI loader is based on this file, made several of the same changes this year; patches 2, 3 and 4 follow them and say so. Valid images are unaffected: the unit tests check PE32 and PE32+ images with 16, 6 or 5 data directories and an unpadded last section, the EFI selftests and the Secure Boot tests pass, and each patch builds on its own. Tested on sandbox. CI: Azure build 13710 passed, all jobs, with this series on https://github.com/u-boot/u-boot/pull/1064, a CI-only pull request, merged with main 03e45557e1f: https://dev.azure.com/u-boot/u-boot/_build/results?buildId=13710 Ana Bobillo (10): efi_loader: check the NT header size in efi_check_pe() efi_loader: check the PE image ranges in efi_image_parse() efi_loader: reject a PE section whose end wraps around efi_loader: check PE section raw data against the image size efi_loader: check that the PE headers fit into the loaded image efi_loader: check the relocation table against the image size efi_loader: check certificate lengths in efi_image_authenticate() efi_loader: do not load an image that cannot be measured test: lib: add tests for the PE image checks test: py: test invalid certificate lengths in signed images lib/efi_loader/efi_image_loader.c | 368 +++++++++++---- test/lib/Makefile | 2 +- test/lib/efi_image_loader.c | 442 ++++++++++++++++++ test/py/tests/test_efi_secboot/conftest.py | 31 ++ test/py/tests/test_efi_secboot/test_signed.py | 36 ++ 5 files changed, 781 insertions(+), 98 deletions(-) create mode 100644 test/lib/efi_image_loader.c base-commit: 03e45557e1f38a39a0c80fe30483130ff376cf92
