The ChromiumOS bootmeth reads the first 4KB of a kernel partition and, after checking only the keyblock magic, uses the on-disk keyblock_size field to locate the kernel preamble within that buffer. Nothing bounds the value, so a corrupt or malicious partition can place the preamble pointer far outside the allocation, and every subsequent preamble field access is an out-of-bounds read. The values fetched this way then drive allocation sizes and disk offsets. On sandbox, scanning such a partition crashes U-Boot with SIGSEGV.
Patch 1 rejects the partition if the keyblock claims to be smaller than its own header, if the preamble does not lie entirely within the probed area, or if the computed kernel body offset falls inside the probed area. The last condition matches what cros_read_kernel() already requires before reading the kernel body, and also catches a preamble_size that wraps the 32-bit sum. Patch 2 adds four malformed kernel partitions to the ChromiumOS test disk, one for each rejected condition: an oversized keyblock_size, an undersized keyblock_size, an undersized kernel body offset and a preamble_size that wraps the 32-bit sum. Without patch 1, the first crashes the bootflow_cros test and the other three scan to spurious ready bootflows; with it, all four partitions are rejected during scanning and all bootstd sandbox tests pass. Aristo Chen (2): bootstd: cros: Validate keyblock_size before locating the preamble test: bootstd: Cover invalid ChromiumOS keyblock and preamble metadata boot/bootmeth_cros.c | 29 ++++++++++++++++++++++++-- test/boot/bootflow.c | 6 ++++++ test/py/tests/test_ut.py | 44 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 77 insertions(+), 2 deletions(-) -- 2.43.0
