diff --git a/SOURCES/edk2-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch b/SOURCES/edk2-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch new file mode 100644 index 0000000..1d83568 --- /dev/null +++ b/SOURCES/edk2-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch @@ -0,0 +1,102 @@ +From b045711f96003a53493cd334fe867981fb3cae2b Mon Sep 17 00:00:00 2001 +From: Laszlo Ersek +Date: Fri, 1 Mar 2019 13:45:07 +0100 +Subject: [PATCH 1/2] MdeModulePkg/PartitionDxe: Ensure blocksize holds MBR + (CVE-2018-12180) + +Message-id: <20190301124508.18497-2-lersek@redhat.com> +Patchwork-id: 84759 +O-Subject: [RHEL-8.0 edk2 PATCH 1/2] MdeModulePkg/PartitionDxe: Ensure blocksize + holds MBR (CVE-2018-12180) +Bugzilla: 1690501 +Acked-by: Thomas Huth +Acked-by: Vitaly Kuznetsov + +From: Hao Wu + +--v-- RHEL-8.0 note --v-- + +Trivial conflicts resolved in "Gpt.c" and "Mbr.c": up-stream, the Intel +copyright notice got meanwhile extended to 2018, in commit d1102dba7210 +("MdeModulePkg: Clean up source files", 2018-06-28). + +--^-- RHEL-8.0 note --^-- + +REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1134 + +The commit adds checks for detecting GPT and MBR partitions. + +These checks will ensure that the device block size is big enough to hold +an MBR (512 bytes). + +Cc: Jian J Wang +Cc: Star Zeng +Cc: Laszlo Ersek +Contributed-under: TianoCore Contribution Agreement 1.1 +Signed-off-by: Hao Wu +Reviewed-by: Ray Ni +(cherry picked from commit fccdb88022c1f6d85c773fce506b10c879063f1d) +Signed-off-by: Laszlo Ersek +Signed-off-by: Danilo C. L. de Paula +--- + MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c | 9 ++++++++- + MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c | 9 ++++++++- + 2 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c b/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c +index fe26a64..141dca0 100644 +--- a/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c ++++ b/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c +@@ -14,7 +14,7 @@ + partition content and validate the GPT table and GPT entry. + + Copyright (c) 2018 Qualcomm Datacenter Technologies, Inc. +-Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.
++Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
+ This program and the accompanying materials + are licensed and made available under the terms and conditions of the BSD License + which accompanies this distribution. The full text of the license may be found at +@@ -237,6 +237,13 @@ PartitionInstallGptChildHandles ( + GptValidStatus = EFI_NOT_FOUND; + + // ++ // Ensure the block size can hold the MBR ++ // ++ if (BlockSize < sizeof (MASTER_BOOT_RECORD)) { ++ return EFI_NOT_FOUND; ++ } ++ ++ // + // Allocate a buffer for the Protective MBR + // + ProtectiveMbr = AllocatePool (BlockSize); +diff --git a/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c b/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c +index 479745b..d7a15b4 100644 +--- a/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c ++++ b/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c +@@ -13,7 +13,7 @@ + + Copyright (c) 2018 Qualcomm Datacenter Technologies, Inc. + Copyright (c) 2014, Hewlett-Packard Development Company, L.P.
+-Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.
++Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
+ This program and the accompanying materials + are licensed and made available under the terms and conditions of the BSD License + which accompanies this distribution. The full text of the license may be found at +@@ -150,6 +150,13 @@ PartitionInstallMbrChildHandles ( + MediaId = BlockIo->Media->MediaId; + LastBlock = BlockIo->Media->LastBlock; + ++ // ++ // Ensure the block size can hold the MBR ++ // ++ if (BlockSize < sizeof (MASTER_BOOT_RECORD)) { ++ return EFI_NOT_FOUND; ++ } ++ + Mbr = AllocatePool (BlockSize); + if (Mbr == NULL) { + return Found; +-- +1.8.3.1 + diff --git a/SOURCES/edk2-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch b/SOURCES/edk2-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch new file mode 100644 index 0000000..82d285b --- /dev/null +++ b/SOURCES/edk2-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch @@ -0,0 +1,137 @@ +From 1fab0b299bc4c5b3f5106f718692f8f9bad5e635 Mon Sep 17 00:00:00 2001 +From: Laszlo Ersek +Date: Fri, 1 Mar 2019 13:45:08 +0100 +Subject: [PATCH 2/2] MdeModulePkg/RamDiskDxe: Restrict on RAM disk size + (CVE-2018-12180) + +Message-id: <20190301124508.18497-3-lersek@redhat.com> +Patchwork-id: 84760 +O-Subject: [RHEL-8.0 edk2 PATCH 2/2] MdeModulePkg/RamDiskDxe: Restrict on RAM + disk size (CVE-2018-12180) +Bugzilla: 1690501 +Acked-by: Thomas Huth +Acked-by: Vitaly Kuznetsov + +From: Hao Wu + +REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1134 + +Originally, the block size of created Ram disks is hard-coded to 512 +bytes. However, if the total size of the Ram disk is not a multiple of 512 +bytes, there will be potential memory access issues when dealing with the +last block of the Ram disk. + +This commit will adjust the block size of the Ram disks to ensure that the +total size is a multiple of the block size. + +Cc: Jian J Wang +Cc: Star Zeng +Cc: Laszlo Ersek +Contributed-under: TianoCore Contribution Agreement 1.1 +Signed-off-by: Hao Wu +Reviewed-by: Ray Ni +(cherry picked from commit 38c9fbdcaa0219eb86fe82d90e3f8cfb5a54be9f) +Signed-off-by: Laszlo Ersek +Signed-off-by: Danilo C. L. de Paula +--- + .../Universal/Disk/RamDiskDxe/RamDiskBlockIo.c | 20 ++++++++++++++------ + MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h | 6 +++--- + .../Universal/Disk/RamDiskDxe/RamDiskProtocol.c | 5 +++-- + 3 files changed, 20 insertions(+), 11 deletions(-) + +diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c +index 4f74b5e..8926ad7 100644 +--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c ++++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c +@@ -1,7 +1,7 @@ + /** @file + Produce EFI_BLOCK_IO_PROTOCOL on a RAM disk device. + +- Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.
++ Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.
+ This program and the accompanying materials + are licensed and made available under the terms and conditions of the BSD License + which accompanies this distribution. The full text of the license may be found at +@@ -54,6 +54,7 @@ RamDiskInitBlockIo ( + EFI_BLOCK_IO_PROTOCOL *BlockIo; + EFI_BLOCK_IO2_PROTOCOL *BlockIo2; + EFI_BLOCK_IO_MEDIA *Media; ++ UINT32 Remainder; + + BlockIo = &PrivateData->BlockIo; + BlockIo2 = &PrivateData->BlockIo2; +@@ -69,11 +70,18 @@ RamDiskInitBlockIo ( + Media->LogicalPartition = FALSE; + Media->ReadOnly = FALSE; + Media->WriteCaching = FALSE; +- Media->BlockSize = RAM_DISK_BLOCK_SIZE; +- Media->LastBlock = DivU64x32 ( +- PrivateData->Size + RAM_DISK_BLOCK_SIZE - 1, +- RAM_DISK_BLOCK_SIZE +- ) - 1; ++ ++ for (Media->BlockSize = RAM_DISK_DEFAULT_BLOCK_SIZE; ++ Media->BlockSize >= 1; ++ Media->BlockSize = Media->BlockSize >> 1) { ++ Media->LastBlock = DivU64x32Remainder (PrivateData->Size, Media->BlockSize, &Remainder) - 1; ++ if (Remainder == 0) { ++ break; ++ } ++ } ++ ASSERT (Media->BlockSize != 0); ++ ++ return; + } + + +diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h +index 077bb77..18c7bb2 100644 +--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h ++++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h +@@ -1,7 +1,7 @@ + /** @file + The header file of RamDiskDxe driver. + +- Copyright (c) 2016, Intel Corporation. All rights reserved.
++ Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.
+ This program and the accompanying materials + are licensed and made available under the terms and conditions of the BSD License + which accompanies this distribution. The full text of the license may be found at +@@ -49,9 +49,9 @@ + /// + + // +-// Block size for RAM disk ++// Default block size for RAM disk + // +-#define RAM_DISK_BLOCK_SIZE 512 ++#define RAM_DISK_DEFAULT_BLOCK_SIZE 512 + + // + // Iterate through the double linked list. NOT delete safe +diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c +index 6784e2b..e8250d5 100644 +--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c ++++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c +@@ -1,7 +1,7 @@ + /** @file + The realization of EFI_RAM_DISK_PROTOCOL. + +- Copyright (c) 2016, Intel Corporation. All rights reserved.
++ Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.
+ (C) Copyright 2016 Hewlett Packard Enterprise Development LP
+ This program and the accompanying materials + are licensed and made available under the terms and conditions of the BSD License +@@ -613,7 +613,8 @@ RamDiskRegister ( + // + // Add check to prevent data read across the memory boundary + // +- if (RamDiskBase + RamDiskSize > ((UINTN) -1) - RAM_DISK_BLOCK_SIZE + 1) { ++ if ((RamDiskSize > MAX_UINTN) || ++ (RamDiskBase > MAX_UINTN - RamDiskSize + 1)) { + return EFI_INVALID_PARAMETER; + } + +-- +1.8.3.1 + diff --git a/SPECS/edk2.spec b/SPECS/edk2.spec index 9d7ca0f..7891d55 100644 --- a/SPECS/edk2.spec +++ b/SPECS/edk2.spec @@ -7,7 +7,7 @@ ExclusiveArch: x86_64 aarch64 Name: edk2 Version: %{GITDATE}git%{GITCOMMIT} -Release: 9%{?dist} +Release: 9%{?dist}.1 Summary: UEFI firmware for 64-bit virtual machines Group: Applications/Emulators License: BSD and OpenSSL and MIT @@ -85,6 +85,10 @@ Patch49: edk2-BaseTools-Fix-UEFI-and-Tiano-Decompression-logic-iss.patch Patch50: edk2-MdePkg-BaseUefiDecompressLib-Fix-UEFI-Decompression-.patch # For bz#1662184 - backport fix for (theoretical?) regression introduced by earlier CVE fixes Patch51: edk2-IntelFrameworkModulePkg-Fix-UEFI-and-Tiano-Decompres.patch +# For bz#1690501 - CVE-2018-12180 edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-8.0.0.z] +Patch52: edk2-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch +# For bz#1690501 - CVE-2018-12180 edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-8.0.0.z] +Patch53: edk2-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch # python2-devel and libuuid-devel are required for building tools @@ -511,6 +515,12 @@ true %endif %changelog +* Tue Mar 26 2019 Danilo Cesar Lemes de Paula - 20180508gitee3198e672e2-9.el8_0 +- edk2-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1690501] +- edk2-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1690501] +- Resolves: bz#1690501 + (CVE-2018-12180 edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-8.0.0.z]) + * Mon Jan 21 2019 Danilo Cesar Lemes de Paula - 20180508gitee3198e672e2-9.el8 - edk2-BaseTools-Fix-UEFI-and-Tiano-Decompression-logic-iss.patch [bz#1662184] - edk2-MdePkg-BaseUefiDecompressLib-Fix-UEFI-Decompression-.patch [bz#1662184]