|
 |
bdb79c |
From 29d5545ca1b9cefb7e813b65e36eb9efc192fbc0 Mon Sep 17 00:00:00 2001
|
|
|
bdb79c |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
Date: Fri, 1 Mar 2019 13:16:46 +0100
|
|
|
bdb79c |
Subject: [PATCH 08/13] MdeModulePkg/PartitionDxe: Ensure blocksize holds MBR
|
|
|
bdb79c |
(CVE-2018-12180)
|
|
|
bdb79c |
|
|
|
bdb79c |
Message-id: <20190301121647.16026-2-lersek@redhat.com>
|
|
|
bdb79c |
Patchwork-id: 84756
|
|
|
bdb79c |
O-Subject: [RHEL-7.7 ovmf PATCH 1/2] MdeModulePkg/PartitionDxe: Ensure blocksize
|
|
|
bdb79c |
holds MBR (CVE-2018-12180)
|
|
|
bdb79c |
Bugzilla: 1684007
|
|
|
bdb79c |
Acked-by: Thomas Huth <thuth@redhat.com>
|
|
|
bdb79c |
Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
bdb79c |
|
|
|
bdb79c |
From: Hao Wu <hao.a.wu@intel.com>
|
|
|
bdb79c |
|
|
|
bdb79c |
--v-- RHEL-7.7 note --v--
|
|
|
bdb79c |
|
|
|
bdb79c |
Trivial conflicts resolved in "Gpt.c" and "Mbr.c": up-stream, the Intel
|
|
|
bdb79c |
copyright notice got meanwhile extended to 2018, in commit d1102dba7210
|
|
|
bdb79c |
("MdeModulePkg: Clean up source files", 2018-06-28).
|
|
|
bdb79c |
|
|
|
bdb79c |
--^-- RHEL-7.7 note --^--
|
|
|
bdb79c |
|
|
|
bdb79c |
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1134
|
|
|
bdb79c |
|
|
|
bdb79c |
The commit adds checks for detecting GPT and MBR partitions.
|
|
|
bdb79c |
|
|
|
bdb79c |
These checks will ensure that the device block size is big enough to hold
|
|
|
bdb79c |
an MBR (512 bytes).
|
|
|
bdb79c |
|
|
|
bdb79c |
Cc: Jian J Wang <jian.j.wang@intel.com>
|
|
|
bdb79c |
Cc: Star Zeng <star.zeng@intel.com>
|
|
|
bdb79c |
Cc: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
Contributed-under: TianoCore Contribution Agreement 1.1
|
|
|
bdb79c |
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
|
|
|
bdb79c |
Reviewed-by: Ray Ni <ray.ni@intel.com>
|
|
|
bdb79c |
(cherry picked from commit fccdb88022c1f6d85c773fce506b10c879063f1d)
|
|
|
bdb79c |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
---
|
|
|
bdb79c |
MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c | 9 ++++++++-
|
|
|
bdb79c |
MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c | 9 ++++++++-
|
|
|
bdb79c |
2 files changed, 16 insertions(+), 2 deletions(-)
|
|
|
bdb79c |
|
|
|
bdb79c |
diff --git a/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c b/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c
|
|
|
bdb79c |
index fe26a64..141dca0 100644
|
|
|
bdb79c |
--- a/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c
|
|
|
bdb79c |
+++ b/MdeModulePkg/Universal/Disk/PartitionDxe/Gpt.c
|
|
|
bdb79c |
@@ -14,7 +14,7 @@
|
|
|
bdb79c |
partition content and validate the GPT table and GPT entry.
|
|
|
bdb79c |
|
|
|
bdb79c |
Copyright (c) 2018 Qualcomm Datacenter Technologies, Inc.
|
|
|
bdb79c |
-Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.
|
|
|
bdb79c |
+Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
|
|
|
bdb79c |
This program and the accompanying materials
|
|
|
bdb79c |
are licensed and made available under the terms and conditions of the BSD License
|
|
|
bdb79c |
which accompanies this distribution. The full text of the license may be found at
|
|
|
bdb79c |
@@ -237,6 +237,13 @@ PartitionInstallGptChildHandles (
|
|
|
bdb79c |
GptValidStatus = EFI_NOT_FOUND;
|
|
|
bdb79c |
|
|
|
bdb79c |
//
|
|
|
bdb79c |
+ // Ensure the block size can hold the MBR
|
|
|
bdb79c |
+ //
|
|
|
bdb79c |
+ if (BlockSize < sizeof (MASTER_BOOT_RECORD)) {
|
|
|
bdb79c |
+ return EFI_NOT_FOUND;
|
|
|
bdb79c |
+ }
|
|
|
bdb79c |
+
|
|
|
bdb79c |
+ //
|
|
|
bdb79c |
// Allocate a buffer for the Protective MBR
|
|
|
bdb79c |
//
|
|
|
bdb79c |
ProtectiveMbr = AllocatePool (BlockSize);
|
|
|
bdb79c |
diff --git a/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c b/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c
|
|
|
bdb79c |
index 479745b..d7a15b4 100644
|
|
|
bdb79c |
--- a/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c
|
|
|
bdb79c |
+++ b/MdeModulePkg/Universal/Disk/PartitionDxe/Mbr.c
|
|
|
bdb79c |
@@ -13,7 +13,7 @@
|
|
|
bdb79c |
|
|
|
bdb79c |
Copyright (c) 2018 Qualcomm Datacenter Technologies, Inc.
|
|
|
bdb79c |
Copyright (c) 2014, Hewlett-Packard Development Company, L.P.
|
|
|
bdb79c |
-Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.
|
|
|
bdb79c |
+Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.
|
|
|
bdb79c |
This program and the accompanying materials
|
|
|
bdb79c |
are licensed and made available under the terms and conditions of the BSD License
|
|
|
bdb79c |
which accompanies this distribution. The full text of the license may be found at
|
|
|
bdb79c |
@@ -150,6 +150,13 @@ PartitionInstallMbrChildHandles (
|
|
|
bdb79c |
MediaId = BlockIo->Media->MediaId;
|
|
|
bdb79c |
LastBlock = BlockIo->Media->LastBlock;
|
|
|
bdb79c |
|
|
|
bdb79c |
+ //
|
|
|
bdb79c |
+ // Ensure the block size can hold the MBR
|
|
|
bdb79c |
+ //
|
|
|
bdb79c |
+ if (BlockSize < sizeof (MASTER_BOOT_RECORD)) {
|
|
|
bdb79c |
+ return EFI_NOT_FOUND;
|
|
|
bdb79c |
+ }
|
|
|
bdb79c |
+
|
|
|
bdb79c |
Mbr = AllocatePool (BlockSize);
|
|
|
bdb79c |
if (Mbr == NULL) {
|
|
|
bdb79c |
return Found;
|
|
|
bdb79c |
--
|
|
|
bdb79c |
1.8.3.1
|
|
|
bdb79c |
|