|
 |
12bdf0 |
From 1e6a8c43241febbec56ffc2141c55d8de34e13e6 Mon Sep 17 00:00:00 2001
|
|
|
12bdf0 |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
Date: Tue, 8 Jun 2021 14:12:55 +0200
|
|
|
12bdf0 |
Subject: [PATCH 06/10] NetworkPkg/IScsiDxe: assert that IScsiBinToHex() always
|
|
|
12bdf0 |
succeeds
|
|
|
12bdf0 |
MIME-Version: 1.0
|
|
|
12bdf0 |
Content-Type: text/plain; charset=UTF-8
|
|
|
12bdf0 |
Content-Transfer-Encoding: 8bit
|
|
|
12bdf0 |
|
|
|
12bdf0 |
RH-Author: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
RH-MergeRequest: 5: NetworkPkg/IScsiDxe: fix IScsiHexToBin() security and functionality bugs [rhel-8.5.0, post-rebase]
|
|
|
12bdf0 |
RH-Commit: [6/10] 2f697819ce0731f99f95f29a3b30c777b754db37
|
|
|
12bdf0 |
RH-Bugzilla: 1956408
|
|
|
12bdf0 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
12bdf0 |
|
|
|
12bdf0 |
IScsiBinToHex() is called for encoding:
|
|
|
12bdf0 |
|
|
|
12bdf0 |
- the answer to the target's challenge; that is, CHAP_R;
|
|
|
12bdf0 |
|
|
|
12bdf0 |
- the challenge for the target, in case mutual authentication is enabled;
|
|
|
12bdf0 |
that is, CHAP_C.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
The initiator controls the size of both blobs, the sizes of their hex
|
|
|
12bdf0 |
encodings are correctly calculated in "RspLen" and "ChallengeLen".
|
|
|
12bdf0 |
Therefore the IScsiBinToHex() calls never fail; assert that.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
|
|
|
12bdf0 |
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
|
|
|
12bdf0 |
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
12bdf0 |
Cc: Siyuan Fu <siyuan.fu@intel.com>
|
|
|
12bdf0 |
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356
|
|
|
12bdf0 |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
12bdf0 |
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
|
|
|
12bdf0 |
Message-Id: <20210608121259.32451-7-lersek@redhat.com>
|
|
|
12bdf0 |
(cherry picked from commit d90fff40cb2502b627370a77f5608c8a178c3f78)
|
|
|
12bdf0 |
---
|
|
|
12bdf0 |
NetworkPkg/IScsiDxe/IScsiCHAP.c | 27 +++++++++++++++------------
|
|
|
12bdf0 |
1 file changed, 15 insertions(+), 12 deletions(-)
|
|
|
12bdf0 |
|
|
|
12bdf0 |
diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
index 9e192ce292..dbe3c8ef46 100644
|
|
|
12bdf0 |
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
@@ -391,6 +391,7 @@ IScsiCHAPToSendReq (
|
|
|
12bdf0 |
UINT32 RspLen;
|
|
|
12bdf0 |
CHAR8 *Challenge;
|
|
|
12bdf0 |
UINT32 ChallengeLen;
|
|
|
12bdf0 |
+ EFI_STATUS BinToHexStatus;
|
|
|
12bdf0 |
|
|
|
12bdf0 |
ASSERT (Conn->CurrentStage == ISCSI_SECURITY_NEGOTIATION);
|
|
|
12bdf0 |
|
|
|
12bdf0 |
@@ -471,12 +472,13 @@ IScsiCHAPToSendReq (
|
|
|
12bdf0 |
//
|
|
|
12bdf0 |
// CHAP_R=<R>
|
|
|
12bdf0 |
//
|
|
|
12bdf0 |
- IScsiBinToHex (
|
|
|
12bdf0 |
- (UINT8 *) AuthData->CHAPResponse,
|
|
|
12bdf0 |
- ISCSI_CHAP_RSP_LEN,
|
|
|
12bdf0 |
- Response,
|
|
|
12bdf0 |
- &RspLen
|
|
|
12bdf0 |
- );
|
|
|
12bdf0 |
+ BinToHexStatus = IScsiBinToHex (
|
|
|
12bdf0 |
+ (UINT8 *) AuthData->CHAPResponse,
|
|
|
12bdf0 |
+ ISCSI_CHAP_RSP_LEN,
|
|
|
12bdf0 |
+ Response,
|
|
|
12bdf0 |
+ &RspLen
|
|
|
12bdf0 |
+ );
|
|
|
12bdf0 |
+ ASSERT_EFI_ERROR (BinToHexStatus);
|
|
|
12bdf0 |
IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_RESPONSE, Response);
|
|
|
12bdf0 |
|
|
|
12bdf0 |
if (AuthData->AuthConfig->CHAPType == ISCSI_CHAP_MUTUAL) {
|
|
|
12bdf0 |
@@ -490,12 +492,13 @@ IScsiCHAPToSendReq (
|
|
|
12bdf0 |
// CHAP_C=<C>
|
|
|
12bdf0 |
//
|
|
|
12bdf0 |
IScsiGenRandom ((UINT8 *) AuthData->OutChallenge, ISCSI_CHAP_RSP_LEN);
|
|
|
12bdf0 |
- IScsiBinToHex (
|
|
|
12bdf0 |
- (UINT8 *) AuthData->OutChallenge,
|
|
|
12bdf0 |
- ISCSI_CHAP_RSP_LEN,
|
|
|
12bdf0 |
- Challenge,
|
|
|
12bdf0 |
- &ChallengeLen
|
|
|
12bdf0 |
- );
|
|
|
12bdf0 |
+ BinToHexStatus = IScsiBinToHex (
|
|
|
12bdf0 |
+ (UINT8 *) AuthData->OutChallenge,
|
|
|
12bdf0 |
+ ISCSI_CHAP_RSP_LEN,
|
|
|
12bdf0 |
+ Challenge,
|
|
|
12bdf0 |
+ &ChallengeLen
|
|
|
12bdf0 |
+ );
|
|
|
12bdf0 |
+ ASSERT_EFI_ERROR (BinToHexStatus);
|
|
|
12bdf0 |
IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_CHALLENGE, Challenge);
|
|
|
12bdf0 |
|
|
|
12bdf0 |
Conn->AuthStep = ISCSI_CHAP_STEP_FOUR;
|
|
|
12bdf0 |
--
|
|
|
12bdf0 |
2.27.0
|
|
|
12bdf0 |
|