Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: 59f024c76ee57c2bec84794536302fc770cd6ec2
https://github.com/tianocore/edk2/commit/59f024c76ee57c2bec84794536302fc770cd6ec2
Author: Gua Guo <[email protected]>
Date: 2024-01-16 (Tue, 16 Jan 2024)
Changed paths:
M UefiPayloadPkg/Library/PayloadEntryHobLib/Hob.c
M UefiPayloadPkg/UefiPayloadEntry/FitUniversalPayloadEntry.c
M UefiPayloadPkg/UefiPayloadEntry/UniversalPayloadEntry.c
Log Message:
-----------
UefiPayloadPkg/Hob: Integer Overflow in CreateHob()
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
Fix integer overflow in various CreateHob instances.
Fixes: CVE-2022-36765
The CreateHob() function aligns the requested size to 8
performing the following operation:
```
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
```
No checks are performed to ensure this value doesn't
overflow, and could lead to CreateHob() returning a smaller
HOB than requested, which could lead to OOB HOB accesses.
Reported-by: Marc Beatove <[email protected]>
Cc: Guo Dong <[email protected]>
Cc: Sean Rhodes <[email protected]>
Cc: James Lu <[email protected]>
Reviewed-by: Gua Guo <[email protected]>
Cc: John Mathew <[email protected]>
Authored-by: Gerd Hoffmann <[email protected]>
Signed-off-by: Gua Guo <[email protected]>
_______________________________________________
edk2-commits mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/edk2-commits
