Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 494127613b36e870250649b02cd4ce5f1969d9bd
https://github.com/tianocore/edk2/commit/494127613b36e870250649b02cd4ce5f1969d9bd
Author: Gerd Hoffmann <kra...@redhat.com>
Date: 2023-03-21 (Tue, 21 Mar 2023)
Changed paths:
M SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
Log Message:
-----------
SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2
Call gRT->GetVariable() directly to read the SecureBoot variable. It is
one byte in size so we can easily place it on the stack instead of
having GetEfiGlobalVariable2() allocate it for us, which avoids a few
possible error cases.
Skip secure boot checks if (and only if):
(a) the SecureBoot variable is not present (EFI_NOT_FOUND) according to
the return value, or
(b) the SecureBoot variable was read successfully and is set to
SECURE_BOOT_MODE_DISABLE.
Previously the code skipped the secure boot checks on *any*
gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable
value to NULL in that case) and also on memory allocation failures.
Fixes: CVE-2019-14560
Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=2167
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
Suggested-by: Marvin Häuser <mhaeu...@posteo.de>
Reviewed-by: Min Xu <min.m...@intel.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
_______________________________________________
edk2-commits mailing list
edk2-commits@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/edk2-commits
