|
|
7c69f2 |
From 1fab0b299bc4c5b3f5106f718692f8f9bad5e635 Mon Sep 17 00:00:00 2001
|
|
|
7c69f2 |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
7c69f2 |
Date: Fri, 1 Mar 2019 13:45:08 +0100
|
|
|
7c69f2 |
Subject: [PATCH 2/2] MdeModulePkg/RamDiskDxe: Restrict on RAM disk size
|
|
|
7c69f2 |
(CVE-2018-12180)
|
|
|
7c69f2 |
|
|
|
7c69f2 |
Message-id: <20190301124508.18497-3-lersek@redhat.com>
|
|
|
7c69f2 |
Patchwork-id: 84760
|
|
|
7c69f2 |
O-Subject: [RHEL-8.0 edk2 PATCH 2/2] MdeModulePkg/RamDiskDxe: Restrict on RAM
|
|
|
7c69f2 |
disk size (CVE-2018-12180)
|
|
|
7c69f2 |
Bugzilla: 1690501
|
|
|
7c69f2 |
Acked-by: Thomas Huth <thuth@redhat.com>
|
|
|
7c69f2 |
Acked-by: Vitaly Kuznetsov <vkuznets@redhat.com>
|
|
|
7c69f2 |
|
|
|
7c69f2 |
From: Hao Wu <hao.a.wu@intel.com>
|
|
|
7c69f2 |
|
|
|
7c69f2 |
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1134
|
|
|
7c69f2 |
|
|
|
7c69f2 |
Originally, the block size of created Ram disks is hard-coded to 512
|
|
|
7c69f2 |
bytes. However, if the total size of the Ram disk is not a multiple of 512
|
|
|
7c69f2 |
bytes, there will be potential memory access issues when dealing with the
|
|
|
7c69f2 |
last block of the Ram disk.
|
|
|
7c69f2 |
|
|
|
7c69f2 |
This commit will adjust the block size of the Ram disks to ensure that the
|
|
|
7c69f2 |
total size is a multiple of the block size.
|
|
|
7c69f2 |
|
|
|
7c69f2 |
Cc: Jian J Wang <jian.j.wang@intel.com>
|
|
|
7c69f2 |
Cc: Star Zeng <star.zeng@intel.com>
|
|
|
7c69f2 |
Cc: Laszlo Ersek <lersek@redhat.com>
|
|
|
7c69f2 |
Contributed-under: TianoCore Contribution Agreement 1.1
|
|
|
7c69f2 |
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
|
|
|
7c69f2 |
Reviewed-by: Ray Ni <ray.ni@intel.com>
|
|
|
7c69f2 |
(cherry picked from commit 38c9fbdcaa0219eb86fe82d90e3f8cfb5a54be9f)
|
|
|
7c69f2 |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
7c69f2 |
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
|
7c69f2 |
---
|
|
|
7c69f2 |
.../Universal/Disk/RamDiskDxe/RamDiskBlockIo.c | 20 ++++++++++++++------
|
|
|
7c69f2 |
MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h | 6 +++---
|
|
|
7c69f2 |
.../Universal/Disk/RamDiskDxe/RamDiskProtocol.c | 5 +++--
|
|
|
7c69f2 |
3 files changed, 20 insertions(+), 11 deletions(-)
|
|
|
7c69f2 |
|
|
|
7c69f2 |
diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
|
|
|
7c69f2 |
index 4f74b5e..8926ad7 100644
|
|
|
7c69f2 |
--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
|
|
|
7c69f2 |
+++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
|
|
|
7c69f2 |
@@ -1,7 +1,7 @@
|
|
|
7c69f2 |
/** @file
|
|
|
7c69f2 |
Produce EFI_BLOCK_IO_PROTOCOL on a RAM disk device.
|
|
|
7c69f2 |
|
|
|
7c69f2 |
- Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.
|
|
|
7c69f2 |
+ Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.
|
|
|
7c69f2 |
This program and the accompanying materials
|
|
|
7c69f2 |
are licensed and made available under the terms and conditions of the BSD License
|
|
|
7c69f2 |
which accompanies this distribution. The full text of the license may be found at
|
|
|
7c69f2 |
@@ -54,6 +54,7 @@ RamDiskInitBlockIo (
|
|
|
7c69f2 |
EFI_BLOCK_IO_PROTOCOL *BlockIo;
|
|
|
7c69f2 |
EFI_BLOCK_IO2_PROTOCOL *BlockIo2;
|
|
|
7c69f2 |
EFI_BLOCK_IO_MEDIA *Media;
|
|
|
7c69f2 |
+ UINT32 Remainder;
|
|
|
7c69f2 |
|
|
|
7c69f2 |
BlockIo = &PrivateData->BlockIo;
|
|
|
7c69f2 |
BlockIo2 = &PrivateData->BlockIo2;
|
|
|
7c69f2 |
@@ -69,11 +70,18 @@ RamDiskInitBlockIo (
|
|
|
7c69f2 |
Media->LogicalPartition = FALSE;
|
|
|
7c69f2 |
Media->ReadOnly = FALSE;
|
|
|
7c69f2 |
Media->WriteCaching = FALSE;
|
|
|
7c69f2 |
- Media->BlockSize = RAM_DISK_BLOCK_SIZE;
|
|
|
7c69f2 |
- Media->LastBlock = DivU64x32 (
|
|
|
7c69f2 |
- PrivateData->Size + RAM_DISK_BLOCK_SIZE - 1,
|
|
|
7c69f2 |
- RAM_DISK_BLOCK_SIZE
|
|
|
7c69f2 |
- ) - 1;
|
|
|
7c69f2 |
+
|
|
|
7c69f2 |
+ for (Media->BlockSize = RAM_DISK_DEFAULT_BLOCK_SIZE;
|
|
|
7c69f2 |
+ Media->BlockSize >= 1;
|
|
|
7c69f2 |
+ Media->BlockSize = Media->BlockSize >> 1) {
|
|
|
7c69f2 |
+ Media->LastBlock = DivU64x32Remainder (PrivateData->Size, Media->BlockSize, &Remainder) - 1;
|
|
|
7c69f2 |
+ if (Remainder == 0) {
|
|
|
7c69f2 |
+ break;
|
|
|
7c69f2 |
+ }
|
|
|
7c69f2 |
+ }
|
|
|
7c69f2 |
+ ASSERT (Media->BlockSize != 0);
|
|
|
7c69f2 |
+
|
|
|
7c69f2 |
+ return;
|
|
|
7c69f2 |
}
|
|
|
7c69f2 |
|
|
|
7c69f2 |
|
|
|
7c69f2 |
diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h
|
|
|
7c69f2 |
index 077bb77..18c7bb2 100644
|
|
|
7c69f2 |
--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h
|
|
|
7c69f2 |
+++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h
|
|
|
7c69f2 |
@@ -1,7 +1,7 @@
|
|
|
7c69f2 |
/** @file
|
|
|
7c69f2 |
The header file of RamDiskDxe driver.
|
|
|
7c69f2 |
|
|
|
7c69f2 |
- Copyright (c) 2016, Intel Corporation. All rights reserved.
|
|
|
7c69f2 |
+ Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.
|
|
|
7c69f2 |
This program and the accompanying materials
|
|
|
7c69f2 |
are licensed and made available under the terms and conditions of the BSD License
|
|
|
7c69f2 |
which accompanies this distribution. The full text of the license may be found at
|
|
|
7c69f2 |
@@ -49,9 +49,9 @@
|
|
|
7c69f2 |
///
|
|
|
7c69f2 |
|
|
|
7c69f2 |
//
|
|
|
7c69f2 |
-// Block size for RAM disk
|
|
|
7c69f2 |
+// Default block size for RAM disk
|
|
|
7c69f2 |
//
|
|
|
7c69f2 |
-#define RAM_DISK_BLOCK_SIZE 512
|
|
|
7c69f2 |
+#define RAM_DISK_DEFAULT_BLOCK_SIZE 512
|
|
|
7c69f2 |
|
|
|
7c69f2 |
//
|
|
|
7c69f2 |
// Iterate through the double linked list. NOT delete safe
|
|
|
7c69f2 |
diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c
|
|
|
7c69f2 |
index 6784e2b..e8250d5 100644
|
|
|
7c69f2 |
--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c
|
|
|
7c69f2 |
+++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c
|
|
|
7c69f2 |
@@ -1,7 +1,7 @@
|
|
|
7c69f2 |
/** @file
|
|
|
7c69f2 |
The realization of EFI_RAM_DISK_PROTOCOL.
|
|
|
7c69f2 |
|
|
|
7c69f2 |
- Copyright (c) 2016, Intel Corporation. All rights reserved.
|
|
|
7c69f2 |
+ Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.
|
|
|
7c69f2 |
(C) Copyright 2016 Hewlett Packard Enterprise Development LP
|
|
|
7c69f2 |
This program and the accompanying materials
|
|
|
7c69f2 |
are licensed and made available under the terms and conditions of the BSD License
|
|
|
7c69f2 |
@@ -613,7 +613,8 @@ RamDiskRegister (
|
|
|
7c69f2 |
//
|
|
|
7c69f2 |
// Add check to prevent data read across the memory boundary
|
|
|
7c69f2 |
//
|
|
|
7c69f2 |
- if (RamDiskBase + RamDiskSize > ((UINTN) -1) - RAM_DISK_BLOCK_SIZE + 1) {
|
|
|
7c69f2 |
+ if ((RamDiskSize > MAX_UINTN) ||
|
|
|
7c69f2 |
+ (RamDiskBase > MAX_UINTN - RamDiskSize + 1)) {
|
|
|
7c69f2 |
return EFI_INVALID_PARAMETER;
|
|
|
7c69f2 |
}
|
|
|
7c69f2 |
|
|
|
7c69f2 |
--
|
|
|
7c69f2 |
1.8.3.1
|
|
|
7c69f2 |
|