|
 |
cc9195 |
From 3b8ff18ad4ac1af740a979ad27fb83dbbdca70ef Mon Sep 17 00:00:00 2001
|
|
|
cc9195 |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
cc9195 |
Date: Wed, 24 Oct 2018 21:03:42 +0200
|
|
|
cc9195 |
Subject: [PATCH 1/4] MdeModulePkg Variable: Fix Timestamp zeroing issue on
|
|
|
cc9195 |
APPEND_WRITE
|
|
|
cc9195 |
|
|
|
cc9195 |
Message-id: <20181024190345.15288-2-lersek@redhat.com>
|
|
|
cc9195 |
Patchwork-id: 82887
|
|
|
cc9195 |
O-Subject: [RHEL8 edk2 PATCH 1/4] MdeModulePkg Variable: Fix Timestamp zeroing
|
|
|
cc9195 |
issue on APPEND_WRITE
|
|
|
cc9195 |
Bugzilla: 1641436
|
|
|
cc9195 |
Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
cc9195 |
Acked-by: Thomas Huth <thuth@redhat.com>
|
|
|
cc9195 |
|
|
|
cc9195 |
From: Star Zeng <star.zeng@intel.com>
|
|
|
cc9195 |
|
|
|
cc9195 |
--v-- RHEL8 note start --v--
|
|
|
cc9195 |
|
|
|
cc9195 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1641436
|
|
|
cc9195 |
|
|
|
cc9195 |
This patch fixes CVE-2018-3613. Unfortunately, the upstream subject line
|
|
|
cc9195 |
does not include the CVE number. I've decided to stick with the upstream
|
|
|
cc9195 |
subject verbatim in the backport, so we can more easily drop this patch at
|
|
|
cc9195 |
the next rebase. On the upstream list, I did complain loudly, so there's
|
|
|
cc9195 |
hope the next CVE fix will advertise the CVE number in the subject.
|
|
|
cc9195 |
|
|
|
cc9195 |
In practice, the vulnerability is difficult to exploit. Please refer to
|
|
|
cc9195 |
the following messages in the upstream discussion:
|
|
|
cc9195 |
|
|
|
cc9195 |
https://lists.01.org/pipermail/edk2-devel/2018-October/031103.html
|
|
|
cc9195 |
https://lists.01.org/pipermail/edk2-devel/2018-October/031140.html
|
|
|
cc9195 |
|
|
|
cc9195 |
--^-- RHEL8 note end --^--
|
|
|
cc9195 |
|
|
|
cc9195 |
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=415
|
|
|
cc9195 |
|
|
|
cc9195 |
When SetVariable() to a time based auth variable with APPEND_WRITE
|
|
|
cc9195 |
attribute, and if the EFI_VARIABLE_AUTHENTICATION_2.TimeStamp in
|
|
|
cc9195 |
the input Data is earlier than current value, it will cause timestamp
|
|
|
cc9195 |
zeroing.
|
|
|
cc9195 |
|
|
|
cc9195 |
This issue may bring time based auth variable downgrade problem.
|
|
|
cc9195 |
For example:
|
|
|
cc9195 |
A vendor released three certs at 2014, 2015, and 2016, and system
|
|
|
cc9195 |
integrated the 2016 cert. User can SetVariable() with 2015 cert and
|
|
|
cc9195 |
APPEND_WRITE attribute to cause timestamp zeroing first, then
|
|
|
cc9195 |
SetVariable() with 2014 cert to downgrade the cert.
|
|
|
cc9195 |
|
|
|
cc9195 |
This patch fixes this issue.
|
|
|
cc9195 |
|
|
|
cc9195 |
Cc: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
cc9195 |
Cc: Chao Zhang <chao.b.zhang@intel.com>
|
|
|
cc9195 |
Cc: Jian J Wang <jian.j.wang@intel.com>
|
|
|
cc9195 |
Contributed-under: TianoCore Contribution Agreement 1.1
|
|
|
cc9195 |
Signed-off-by: Star Zeng <star.zeng@intel.com>
|
|
|
cc9195 |
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
|
|
|
cc9195 |
(cherry picked from commit b7dc8888f31402f410c53242839271ba3b94b619)
|
|
|
cc9195 |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
cc9195 |
---
|
|
|
cc9195 |
MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 2 ++
|
|
|
cc9195 |
1 file changed, 2 insertions(+)
|
|
|
cc9195 |
|
|
|
cc9195 |
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
|
cc9195 |
index 6caf603..60439b5 100644
|
|
|
cc9195 |
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
|
cc9195 |
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
|
cc9195 |
@@ -2460,6 +2460,8 @@ UpdateVariable (
|
|
|
cc9195 |
if (Variable->CurrPtr != NULL) {
|
|
|
cc9195 |
if (VariableCompareTimeStampInternal (&(((AUTHENTICATED_VARIABLE_HEADER *) CacheVariable->CurrPtr)->TimeStamp), TimeStamp)) {
|
|
|
cc9195 |
CopyMem (&AuthVariable->TimeStamp, TimeStamp, sizeof (EFI_TIME));
|
|
|
cc9195 |
+ } else {
|
|
|
cc9195 |
+ CopyMem (&AuthVariable->TimeStamp, &(((AUTHENTICATED_VARIABLE_HEADER *) CacheVariable->CurrPtr)->TimeStamp), sizeof (EFI_TIME));
|
|
|
cc9195 |
}
|
|
|
cc9195 |
}
|
|
|
cc9195 |
}
|
|
|
cc9195 |
--
|
|
|
cc9195 |
1.8.3.1
|
|
|
cc9195 |
|