|
 |
e97c83 |
From 034466b7734a2749346151d903bbd7c8a1288db1 Mon Sep 17 00:00:00 2001
|
|
|
e97c83 |
From: Sebastian Krahmer <krahmer@suse.com>
|
|
|
e97c83 |
Date: Tue, 12 Aug 2014 09:23:28 +0000
|
|
|
e97c83 |
Subject: [PATCH 71/74] OOB access when parsing MOK List/Certificates on MOK
|
|
|
e97c83 |
enrollment
|
|
|
e97c83 |
|
|
|
e97c83 |
---
|
|
|
e97c83 |
MokManager.c | 30 ++++++++++++++++++++++++++++++
|
|
|
e97c83 |
1 file changed, 30 insertions(+)
|
|
|
e97c83 |
|
|
|
e97c83 |
diff --git a/MokManager.c b/MokManager.c
|
|
|
e97c83 |
index ecbcdd3..4a9b102 100644
|
|
|
e97c83 |
--- a/MokManager.c
|
|
|
e97c83 |
+++ b/MokManager.c
|
|
|
e97c83 |
@@ -100,8 +100,18 @@ static UINT32 count_keys(void *Data, UINTN DataSize)
|
|
|
e97c83 |
EFI_GUID HashType = EFI_CERT_SHA256_GUID;
|
|
|
e97c83 |
UINTN dbsize = DataSize;
|
|
|
e97c83 |
UINT32 MokNum = 0;
|
|
|
e97c83 |
+ void *end = Data + DataSize;
|
|
|
e97c83 |
|
|
|
e97c83 |
while ((dbsize > 0) && (dbsize >= CertList->SignatureListSize)) {
|
|
|
e97c83 |
+
|
|
|
e97c83 |
+ /* Use ptr arithmetics to ensure bounded access. Do not allow 0
|
|
|
e97c83 |
+ * SignatureListSize that will cause endless loop.
|
|
|
e97c83 |
+ */
|
|
|
e97c83 |
+ if ((void *)(CertList + 1) > end || CertList->SignatureListSize == 0) {
|
|
|
e97c83 |
+ console_notify(L"Invalid MOK detected! Ignoring MOK List.");
|
|
|
e97c83 |
+ return 0;
|
|
|
e97c83 |
+ }
|
|
|
e97c83 |
+
|
|
|
e97c83 |
if ((CompareGuid (&CertList->SignatureType, &CertType) != 0) &&
|
|
|
e97c83 |
(CompareGuid (&CertList->SignatureType, &HashType) != 0)) {
|
|
|
e97c83 |
console_notify(L"Doesn't look like a key or hash");
|
|
|
e97c83 |
@@ -137,6 +147,7 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
|
|
|
e97c83 |
EFI_GUID HashType = EFI_CERT_SHA256_GUID;
|
|
|
e97c83 |
UINTN dbsize = DataSize;
|
|
|
e97c83 |
UINTN count = 0;
|
|
|
e97c83 |
+ void *end = Data + DataSize;
|
|
|
e97c83 |
|
|
|
e97c83 |
list = AllocatePool(sizeof(MokListNode) * num);
|
|
|
e97c83 |
|
|
|
e97c83 |
@@ -146,6 +157,11 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
|
|
|
e97c83 |
}
|
|
|
e97c83 |
|
|
|
e97c83 |
while ((dbsize > 0) && (dbsize >= CertList->SignatureListSize)) {
|
|
|
e97c83 |
+ /* CertList out of bounds? */
|
|
|
e97c83 |
+ if ((void *)(CertList + 1) > end || CertList->SignatureListSize == 0) {
|
|
|
e97c83 |
+ FreePool(list);
|
|
|
e97c83 |
+ return NULL;
|
|
|
e97c83 |
+ }
|
|
|
e97c83 |
if ((CompareGuid (&CertList->SignatureType, &CertType) != 0) &&
|
|
|
e97c83 |
(CompareGuid (&CertList->SignatureType, &HashType) != 0)) {
|
|
|
e97c83 |
dbsize -= CertList->SignatureListSize;
|
|
|
e97c83 |
@@ -165,10 +181,22 @@ static MokListNode *build_mok_list(UINT32 num, void *Data, UINTN DataSize) {
|
|
|
e97c83 |
Cert = (EFI_SIGNATURE_DATA *) (((UINT8 *) CertList) +
|
|
|
e97c83 |
sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
|
|
|
e97c83 |
|
|
|
e97c83 |
+ /* Cert out of bounds? */
|
|
|
e97c83 |
+ if ((void *)(Cert + 1) > end || CertList->SignatureSize <= sizeof(EFI_GUID)) {
|
|
|
e97c83 |
+ FreePool(list);
|
|
|
e97c83 |
+ return NULL;
|
|
|
e97c83 |
+ }
|
|
|
e97c83 |
+
|
|
|
e97c83 |
list[count].MokSize = CertList->SignatureSize - sizeof(EFI_GUID);
|
|
|
e97c83 |
list[count].Mok = (void *)Cert->SignatureData;
|
|
|
e97c83 |
list[count].Type = CertList->SignatureType;
|
|
|
e97c83 |
|
|
|
e97c83 |
+ /* MOK out of bounds? */
|
|
|
e97c83 |
+ if (list[count].MokSize > end - (void *)list[count].Mok) {
|
|
|
e97c83 |
+ FreePool(list);
|
|
|
e97c83 |
+ return NULL;
|
|
|
e97c83 |
+ }
|
|
|
e97c83 |
+
|
|
|
e97c83 |
count++;
|
|
|
e97c83 |
dbsize -= CertList->SignatureListSize;
|
|
|
e97c83 |
CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList +
|
|
|
e97c83 |
@@ -449,6 +477,8 @@ static EFI_STATUS list_keys (void *KeyList, UINTN KeyListSize, CHAR16 *title)
|
|
|
e97c83 |
}
|
|
|
e97c83 |
|
|
|
e97c83 |
MokNum = count_keys(KeyList, KeyListSize);
|
|
|
e97c83 |
+ if (MokNum == 0)
|
|
|
e97c83 |
+ return 0;
|
|
|
e97c83 |
keys = build_mok_list(MokNum, KeyList, KeyListSize);
|
|
|
e97c83 |
|
|
|
e97c83 |
if (!keys) {
|
|
|
e97c83 |
--
|
|
|
e97c83 |
1.9.3
|
|
|
e97c83 |
|