Re: [edk2-devel] [PATCH 2/9] SecurityPkg/DxeImageVerificationLib: reject CertStack.CertNumber==0 per DBX(CVE-2019-14575)

2020-02-13 Thread Yao, Jiewen
Reviewed-by: Jiewen Yao > -Original Message- > From: Wang, Jian J > Sent: Thursday, February 6, 2020 10:19 PM > To: devel@edk2.groups.io > Cc: Yao, Jiewen ; Zhang, Chao B > ; Laszlo Ersek > Subject: [PATCH 2/9] SecurityPkg/DxeImageVerificationLib: reject > CertStack.CertNumber==0 per

[edk2-devel] [PATCH 2/9] SecurityPkg/DxeImageVerificationLib: reject CertStack.CertNumber==0 per DBX(CVE-2019-14575)

2020-02-06 Thread Wang, Jian J
In case the signers' certificate stack, retrieved from the PE/COFF image's Authenticode blob, has zero elements (= there are zero signer certificates), then we should consider the image forbidden by DBX, not accepted by DBX. Cc: Jiewen Yao Cc: Chao Zhang Signed-off-by: Jian J Wang Reviewed-by: