[edk2-devel] [PATCH 8/9] SecurityPkg/DxeImageVerificationLib: plug Data leak in IsForbiddenByDbx()(CVE-2019-14575)
Philippe Mathieu-Daudé
philmd at redhat.com
Thu Feb 13 16:56:16 UTC 2020
On 2/6/20 3:19 PM, Wang, Jian J wrote:
> From: Laszlo Ersek <lersek at redhat.com>
>
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1608
What a painful review...
> If the second GetVariable() call for "dbx" fails, in IsForbiddenByDbx(),
> we have to free Data. Jump to "Done" for that.
>
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Chao Zhang <chao.b.zhang at intel.com>
> Signed-off-by: Laszlo Ersek <lersek at redhat.com>
> ---
> .../Library/DxeImageVerificationLib/DxeImageVerificationLib.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> index 2236ce98ce..5b7a67f811 100644
> --- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> +++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
> @@ -1274,7 +1274,7 @@ IsForbiddenByDbx (
>
> Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, (VOID *) Data);
> if (EFI_ERROR (Status)) {
> - return IsForbidden;
> + goto Done;
> }
>
> //
>
Reviewed-by: Philippe Mathieu-Daudé <philmd at redhat.com>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#54369): https://edk2.groups.io/g/devel/message/54369
Mute This Topic: https://groups.io/mt/71023426/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list