authenticode_parse() walks the DER of a PKCS#7 signature taken from the image before anything about the image is verified. Fuzz it, and the digest of the signed attributes it hands on, the way the PE parser is fuzzed.
As EFI_PE_PARSER does for the PE parser, a separate EFI_AUTHENTICODE builds the verifier without the EFI loader under COMPILE_TEST; EFI_LOADER_AUTHENTICODE selects it. The libfuzzer configuration enables it. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Johannes Schneider <[email protected]> --- common/boards/configs/libfuzzer.config | 1 + efi/Kconfig | 11 +++++++++++ efi/loader/Kconfig | 2 +- efi/loader/Makefile | 2 +- efi/loader/authenticode.c | 13 +++++++++++++ 5 files changed, 27 insertions(+), 2 deletions(-) diff --git a/common/boards/configs/libfuzzer.config b/common/boards/configs/libfuzzer.config index f0a298559f..40c90d644a 100644 --- a/common/boards/configs/libfuzzer.config +++ b/common/boards/configs/libfuzzer.config @@ -16,6 +16,7 @@ CONFIG_DEBUG_MEMLEAK=y CONFIG_TEST=y CONFIG_COMPILE_TEST=y CONFIG_EFI_PE_PARSER=y +CONFIG_EFI_AUTHENTICODE=y CONFIG_JWT=y CONFIG_FUZZ=y CONFIG_FUZZ_EXTERNAL=y diff --git a/efi/Kconfig b/efi/Kconfig index e3f3941831..6c8d6b9de4 100644 --- a/efi/Kconfig +++ b/efi/Kconfig @@ -12,6 +12,17 @@ config EFI_PE_PARSER This can be enabled without the full EFI loader to compile-test and fuzz PE image parsing. +config EFI_AUTHENTICODE + bool "Authenticode signature verifier" if COMPILE_TEST + depends on CRYPTO_BUILTIN_KEYS && HAVE_DIGEST_SHA256 + select CRYPTO_RSA + select EFI_PE_PARSER + help + Build the Authenticode (PKCS#7) verifier used by the EFI loader. + + This can be enabled without the full EFI loader to compile-test and + fuzz the parsing of Authenticode signatures. + config EFI_PAYLOAD bool "barebox as EFI payload/app (consumer)" depends on HAVE_EFI_PAYLOAD || COMPILE_TEST diff --git a/efi/loader/Kconfig b/efi/loader/Kconfig index 4099da0689..8345fccd1a 100644 --- a/efi/loader/Kconfig +++ b/efi/loader/Kconfig @@ -27,7 +27,7 @@ config EFI_LOADER_SECURE_BOOT config EFI_LOADER_AUTHENTICODE bool "Verify Authenticode signatures of booted EFI images" depends on CRYPTO_BUILTIN_KEYS && HAVE_DIGEST_SHA256 - select CRYPTO_RSA + select EFI_AUTHENTICODE help Verify the Authenticode (PKCS#7, SHA-256, RSA) signature of an EFI image booted with bootm against the keys compiled into the "efi" diff --git a/efi/loader/Makefile b/efi/loader/Makefile index 775014dc22..f590fb278a 100644 --- a/efi/loader/Makefile +++ b/efi/loader/Makefile @@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 obj-$(CONFIG_EFI_PE_PARSER) += pe.o +obj-$(CONFIG_EFI_AUTHENTICODE) += authenticode.o ifeq ($(CONFIG_EFI_LOADER),y) @@ -14,7 +15,6 @@ obj-y += boot.o obj-y += runtime.o obj-y += setup.o obj-y += watchdog.o -obj-$(CONFIG_EFI_LOADER_AUTHENTICODE) += authenticode.o obj-y += loadopts.o obj-y += efi_var_common.o obj-y += efi_variable.o diff --git a/efi/loader/authenticode.c b/efi/loader/authenticode.c index 36e5a46fc6..ef2ea895e1 100644 --- a/efi/loader/authenticode.c +++ b/efi/loader/authenticode.c @@ -15,6 +15,7 @@ #include <efi/loader/authenticode.h> #include <efi/error.h> #include <pe.h> +#include <fuzz.h> struct der { const u8 *p; @@ -340,6 +341,18 @@ static int sha256_attrs(const struct authenticode *a, u8 *out) return ret; } +static int fuzz_authenticode(const u8 *data, size_t size) +{ + struct authenticode a = {}; + u8 hash[SHA256_DIGEST_SIZE]; + + if (!authenticode_parse(&a, data, size)) + sha256_attrs(&a, hash); + + return 0; +} +fuzz_test("authenticode", fuzz_authenticode); + /** * efi_authenticode_verify() - verify a PE image's Authenticode signature * @efi: PE image -- 2.43.0
