|
 |
12bdf0 |
From 5171f67062e606a4e606780ff5a5787bde7198eb Mon Sep 17 00:00:00 2001
|
|
|
12bdf0 |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
Date: Tue, 8 Jun 2021 14:12:59 +0200
|
|
|
12bdf0 |
Subject: [PATCH 10/10] NetworkPkg/IScsiDxe: check IScsiHexToBin() return
|
|
|
12bdf0 |
values
|
|
|
12bdf0 |
MIME-Version: 1.0
|
|
|
12bdf0 |
Content-Type: text/plain; charset=UTF-8
|
|
|
12bdf0 |
Content-Transfer-Encoding: 8bit
|
|
|
12bdf0 |
|
|
|
12bdf0 |
RH-Author: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
RH-MergeRequest: 5: NetworkPkg/IScsiDxe: fix IScsiHexToBin() security and functionality bugs [rhel-8.5.0, post-rebase]
|
|
|
12bdf0 |
RH-Commit: [10/10] 1c65763fef57cfd9b1bd55779ec6eba4e086e100
|
|
|
12bdf0 |
RH-Bugzilla: 1956408
|
|
|
12bdf0 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
12bdf0 |
|
|
|
12bdf0 |
IScsiDxe (that is, the initiator) receives two hex-encoded strings from
|
|
|
12bdf0 |
the iSCSI target:
|
|
|
12bdf0 |
|
|
|
12bdf0 |
- CHAP_C, where the target challenges the initiator,
|
|
|
12bdf0 |
|
|
|
12bdf0 |
- CHAP_R, where the target answers the challenge from the initiator (in
|
|
|
12bdf0 |
case the initiator wants mutual authentication).
|
|
|
12bdf0 |
|
|
|
12bdf0 |
Accordingly, we have two IScsiHexToBin() call sites:
|
|
|
12bdf0 |
|
|
|
12bdf0 |
- At the CHAP_C decoding site, check whether the decoding succeeds. The
|
|
|
12bdf0 |
decoded buffer ("AuthData->InChallenge") can accommodate 1024 bytes,
|
|
|
12bdf0 |
which is a permissible restriction on the target, per
|
|
|
12bdf0 |
<https://tools.ietf.org/html/rfc7143#section-12.1.3>. Shorter challenges
|
|
|
12bdf0 |
from the target are acceptable.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
- At the CHAP_R decoding site, enforce that the decoding both succeed, and
|
|
|
12bdf0 |
provide exactly ISCSI_CHAP_RSP_LEN bytes. CHAP_R contains the digest
|
|
|
12bdf0 |
calculated by the target, therefore it must be of fixed size. We may
|
|
|
12bdf0 |
only call IScsiCHAPAuthTarget() if "TargetRsp" has been fully populated.
|
|
|
12bdf0 |
|
|
|
12bdf0 |
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
|
|
|
12bdf0 |
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
|
|
|
12bdf0 |
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
12bdf0 |
Cc: Siyuan Fu <siyuan.fu@intel.com>
|
|
|
12bdf0 |
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356
|
|
|
12bdf0 |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
12bdf0 |
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
12bdf0 |
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
|
|
|
12bdf0 |
Message-Id: <20210608121259.32451-11-lersek@redhat.com>
|
|
|
12bdf0 |
(cherry picked from commit b8649cf2a3e673a4a8cb6c255e394b354b771550)
|
|
|
12bdf0 |
---
|
|
|
12bdf0 |
NetworkPkg/IScsiDxe/IScsiCHAP.c | 20 ++++++++++++++------
|
|
|
12bdf0 |
1 file changed, 14 insertions(+), 6 deletions(-)
|
|
|
12bdf0 |
|
|
|
12bdf0 |
diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
index dbe3c8ef46..7e930c0d1e 100644
|
|
|
12bdf0 |
--- a/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c
|
|
|
12bdf0 |
@@ -290,11 +290,15 @@ IScsiCHAPOnRspReceived (
|
|
|
12bdf0 |
|
|
|
12bdf0 |
AuthData->InIdentifier = (UINT32) Result;
|
|
|
12bdf0 |
AuthData->InChallengeLength = (UINT32) sizeof (AuthData->InChallenge);
|
|
|
12bdf0 |
- IScsiHexToBin (
|
|
|
12bdf0 |
- (UINT8 *) AuthData->InChallenge,
|
|
|
12bdf0 |
- &AuthData->InChallengeLength,
|
|
|
12bdf0 |
- Challenge
|
|
|
12bdf0 |
- );
|
|
|
12bdf0 |
+ Status = IScsiHexToBin (
|
|
|
12bdf0 |
+ (UINT8 *) AuthData->InChallenge,
|
|
|
12bdf0 |
+ &AuthData->InChallengeLength,
|
|
|
12bdf0 |
+ Challenge
|
|
|
12bdf0 |
+ );
|
|
|
12bdf0 |
+ if (EFI_ERROR (Status)) {
|
|
|
12bdf0 |
+ Status = EFI_PROTOCOL_ERROR;
|
|
|
12bdf0 |
+ goto ON_EXIT;
|
|
|
12bdf0 |
+ }
|
|
|
12bdf0 |
Status = IScsiCHAPCalculateResponse (
|
|
|
12bdf0 |
AuthData->InIdentifier,
|
|
|
12bdf0 |
AuthData->AuthConfig->CHAPSecret,
|
|
|
12bdf0 |
@@ -337,7 +341,11 @@ IScsiCHAPOnRspReceived (
|
|
|
12bdf0 |
}
|
|
|
12bdf0 |
|
|
|
12bdf0 |
RspLen = ISCSI_CHAP_RSP_LEN;
|
|
|
12bdf0 |
- IScsiHexToBin (TargetRsp, &RspLen, Response);
|
|
|
12bdf0 |
+ Status = IScsiHexToBin (TargetRsp, &RspLen, Response);
|
|
|
12bdf0 |
+ if (EFI_ERROR (Status) || RspLen != ISCSI_CHAP_RSP_LEN) {
|
|
|
12bdf0 |
+ Status = EFI_PROTOCOL_ERROR;
|
|
|
12bdf0 |
+ goto ON_EXIT;
|
|
|
12bdf0 |
+ }
|
|
|
12bdf0 |
|
|
|
12bdf0 |
//
|
|
|
12bdf0 |
// Check the CHAP Name and Response replied by Target.
|
|
|
12bdf0 |
--
|
|
|
12bdf0 |
2.27.0
|
|
|
12bdf0 |
|