[edk2-devel] [PATCH v2 1/1] SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2
Gerd Hoffmann
kraxel at redhat.com
Mon Mar 20 10:02:08 UTC 2023
On Fri, Mar 03, 2023 at 11:35:53AM +0100, Gerd Hoffmann wrote:
> Call gRT->GetVariable() directly to read the SecureBoot variable. It is
> one byte in size so we can easily place it on the stack instead of
> having GetEfiGlobalVariable2() allocate it for us, which avoids a few
> possible error cases.
>
> Skip secure boot checks if (and only if):
>
> (a) the SecureBoot variable is not present (EFI_NOT_FOUND) according to
> the return value, or
> (b) the SecureBoot variable was read successfully and is set to
> SECURE_BOOT_MODE_DISABLE.
>
> Previously the code skipped the secure boot checks on *any*
> gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable
> value to NULL in that case) and also on memory allocation failures.
>
> Fixes: CVE-2019-14560
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=2167
> Signed-off-by: Gerd Hoffmann <kraxel at redhat.com>
Ping. Any comments on this patch?
take care,
Gerd
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#101425): https://edk2.groups.io/g/devel/message/101425
Mute This Topic: https://groups.io/mt/97359253/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list