|
 |
bdb79c |
From 0afba771bf42a9793e86bc565f23a8ca99d53dbb Mon Sep 17 00:00:00 2001
|
|
|
bdb79c |
From: Philippe Mathieu-Daude <philmd@redhat.com>
|
|
|
bdb79c |
Date: Wed, 13 Feb 2019 09:50:44 +0100
|
|
|
bdb79c |
Subject: [PATCH 01/13] MdeModulePkg Variable: Fix Timestamp zeroing issue on
|
|
|
bdb79c |
APPEND_WRITE
|
|
|
bdb79c |
|
|
|
bdb79c |
Message-id: <20190213085050.20766-2-philmd@redhat.com>
|
|
|
bdb79c |
Patchwork-id: 84478
|
|
|
bdb79c |
O-Subject: [RHEL-7.7 ovmf PATCH v3 1/7] MdeModulePkg Variable: Fix Timestamp
|
|
|
bdb79c |
zeroing issue on APPEND_WRITE
|
|
|
bdb79c |
Bugzilla: 1666586
|
|
|
bdb79c |
Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
bdb79c |
|
|
|
bdb79c |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
|
|
|
bdb79c |
From: Star Zeng <star.zeng@intel.com>
|
|
|
bdb79c |
|
|
|
bdb79c |
--v-- RHEL7 note start --v--
|
|
|
bdb79c |
|
|
|
bdb79c |
This patch fixes CVE-2018-3613. Unfortunately, the upstream subject line
|
|
|
bdb79c |
does not include the CVE number. I've decided to stick with the upstream
|
|
|
bdb79c |
subject verbatim in the backport, so we can more easily drop this patch at
|
|
|
bdb79c |
the next rebase. On the upstream list, I did complain loudly, so there's
|
|
|
bdb79c |
hope the next CVE fix will advertise the CVE number in the subject.
|
|
|
bdb79c |
|
|
|
bdb79c |
In practice, the vulnerability is difficult to exploit. Please refer to
|
|
|
bdb79c |
the following messages in the upstream discussion:
|
|
|
bdb79c |
|
|
|
bdb79c |
https://lists.01.org/pipermail/edk2-devel/2018-October/031103.html
|
|
|
bdb79c |
https://lists.01.org/pipermail/edk2-devel/2018-October/031140.html
|
|
|
bdb79c |
|
|
|
bdb79c |
--^-- RHEL7 note end --^--
|
|
|
bdb79c |
|
|
|
bdb79c |
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=415
|
|
|
bdb79c |
|
|
|
bdb79c |
When SetVariable() to a time based auth variable with APPEND_WRITE
|
|
|
bdb79c |
attribute, and if the EFI_VARIABLE_AUTHENTICATION_2.TimeStamp in
|
|
|
bdb79c |
the input Data is earlier than current value, it will cause timestamp
|
|
|
bdb79c |
zeroing.
|
|
|
bdb79c |
|
|
|
bdb79c |
This issue may bring time based auth variable downgrade problem.
|
|
|
bdb79c |
For example:
|
|
|
bdb79c |
A vendor released three certs at 2014, 2015, and 2016, and system
|
|
|
bdb79c |
integrated the 2016 cert. User can SetVariable() with 2015 cert and
|
|
|
bdb79c |
APPEND_WRITE attribute to cause timestamp zeroing first, then
|
|
|
bdb79c |
SetVariable() with 2014 cert to downgrade the cert.
|
|
|
bdb79c |
|
|
|
bdb79c |
This patch fixes this issue.
|
|
|
bdb79c |
|
|
|
bdb79c |
Cc: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
bdb79c |
Cc: Chao Zhang <chao.b.zhang@intel.com>
|
|
|
bdb79c |
Cc: Jian J Wang <jian.j.wang@intel.com>
|
|
|
bdb79c |
Contributed-under: TianoCore Contribution Agreement 1.1
|
|
|
bdb79c |
Signed-off-by: Star Zeng <star.zeng@intel.com>
|
|
|
bdb79c |
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
bdb79c |
(cherry picked from commit b7dc8888f31402f410c53242839271ba3b94b619)
|
|
|
bdb79c |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
bdb79c |
(cherry picked from commit 3b8ff18ad4ac1af740a979ad27fb83dbbdca70ef)
|
|
|
bdb79c |
Signed-off-by: Philippe Mathieu-Daude <philmd@redhat.com>
|
|
|
bdb79c |
---
|
|
|
bdb79c |
MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 2 ++
|
|
|
bdb79c |
1 file changed, 2 insertions(+)
|
|
|
bdb79c |
|
|
|
bdb79c |
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
|
bdb79c |
index 6caf603..60439b5 100644
|
|
|
bdb79c |
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
|
bdb79c |
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
|
bdb79c |
@@ -2460,6 +2460,8 @@ UpdateVariable (
|
|
|
bdb79c |
if (Variable->CurrPtr != NULL) {
|
|
|
bdb79c |
if (VariableCompareTimeStampInternal (&(((AUTHENTICATED_VARIABLE_HEADER *) CacheVariable->CurrPtr)->TimeStamp), TimeStamp)) {
|
|
|
bdb79c |
CopyMem (&AuthVariable->TimeStamp, TimeStamp, sizeof (EFI_TIME));
|
|
|
bdb79c |
+ } else {
|
|
|
bdb79c |
+ CopyMem (&AuthVariable->TimeStamp, &(((AUTHENTICATED_VARIABLE_HEADER *) CacheVariable->CurrPtr)->TimeStamp), sizeof (EFI_TIME));
|
|
|
bdb79c |
}
|
|
|
bdb79c |
}
|
|
|
bdb79c |
}
|
|
|
bdb79c |
--
|
|
|
bdb79c |
1.8.3.1
|
|
|
bdb79c |
|