From: Ana Bobillo <[email protected]>
efi_remove_auth_hdr() skips the authentication header of an image by
the dwLength of its certificate without checking it against the image
size. A dwLength larger than the image makes the image size wrap
around:
- with CONFIG_EFI_CAPSULE_AUTHENTICATE, efi_capsule_authenticate()
then parses dwLength bytes of certificate past the end of the image
before the signature is checked;
- without it, efi_capsule_update_firmware() passes the wrapped image
size on to the FMP driver.
Reject a certificate that does not fit in the image.
Fixes: 04be98bd6bcf ("efi: capsule: Add support for uefi capsule
authentication")
Fixes: c2cc60c1f93b ("efi_loader: capsule: remove authentication data")
Signed-off-by: Ana Bobillo <[email protected]>
---
lib/efi_loader/efi_capsule.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c
index a8d57630a6f..a3da22aa396 100644
--- a/lib/efi_loader/efi_capsule.c
+++ b/lib/efi_loader/efi_capsule.c
@@ -270,7 +270,9 @@ static efi_status_t efi_remove_auth_hdr(void **image,
efi_uintn_t *image_size)
goto out;
if (auth_hdr->auth_info.hdr.dwLength <=
- offsetof(struct win_certificate_uefi_guid, cert_data))
+ offsetof(struct win_certificate_uefi_guid, cert_data) ||
+ auth_hdr->auth_info.hdr.dwLength >
+ *image_size - sizeof(auth_hdr->monotonic_count))
goto out;
*image = (uint8_t *)*image + sizeof(auth_hdr->monotonic_count) +
