Skip to content

Commit 610f91c

Browse files
arc9693arc9693
authored
hvloader: add patch to resolve CVE-2024-1298 (#9337)
1 parent 65cae39 commit 610f91c

3 files changed

Lines changed: 55 additions & 3 deletions

File tree

‎SPECS-SIGNED/hvloader-signed/hvloader-signed.spec‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Signed HvLoader.efi for %{buildarch} systems
77
Name: hvloader-signed-%{buildarch}
88
Version: 1.0.1
9-
Release: 3%{?dist}
9+
Release: 4%{?dist}
1010
License: MIT
1111
Vendor: Microsoft Corporation
1212
Distribution: Mariner
@@ -69,7 +69,10 @@ popd
6969
/boot/efi/HvLoader.efi
7070

7171
%changelog
72-
* Fri May 31 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-3.cm2
72+
* Thu Jun 06 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-4
73+
- Update version for consistency with hvloader spec
74+
75+
* Fri May 31 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-3
7376
- Update version for consistency with hvloader spec
7477

7578
* Fri May 10 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-2

‎SPECS/hvloader/CVE-2024-1298.patch‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From 284dbac43da752ee34825c8b3f6f9e8281cb5a19 Mon Sep 17 00:00:00 2001
2+
From: Shanmugavel Pakkirisamy <shanmugavelx.pakkirisamy@intel.com>
3+
Date: Mon, 6 May 2024 17:53:09 +0800
4+
Subject: [PATCH] MdeModulePkg: Potential UINT32 overflow in S3 ResumeCount
5+
6+
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4677
7+
8+
Attacker able to modify physical memory and ResumeCount.
9+
System will crash/DoS when ResumeCount reaches its MAX_UINT32.
10+
11+
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
12+
Cc: Dandan Bi <dandan.bi@intel.com>
13+
Cc: Liming Gao <gaoliming@byosoft.com.cn>
14+
15+
Signed-off-by: Pakkirisamy ShanmugavelX <shanmugavelx.pakkirisamy@intel.com>
16+
Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
17+
---
18+
.../FirmwarePerformancePei.c | 12 ++++++++----
19+
1 file changed, 8 insertions(+), 4 deletions(-)
20+
21+
diff --git a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
22+
index 2f2b2a80b25b..2ba9215226d5 100644
23+
--- a/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
24+
+++ b/MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTablePei/FirmwarePerformancePei.c
25+
@@ -112,11 +112,15 @@ FpdtStatusCodeListenerPei (
26+
//
27+
S3ResumeTotal = MultU64x32 (AcpiS3ResumeRecord->AverageResume, AcpiS3ResumeRecord->ResumeCount);
28+
AcpiS3ResumeRecord->ResumeCount++;
29+
- AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
30+
+ if (AcpiS3ResumeRecord->ResumeCount > 0) {
31+
+ AcpiS3ResumeRecord->AverageResume = DivU64x32 (S3ResumeTotal + AcpiS3ResumeRecord->FullResume, AcpiS3ResumeRecord->ResumeCount);
32+
+ DEBUG ((DEBUG_INFO, "\nFPDT: S3 Resume Performance - AverageResume = 0x%x\n", AcpiS3ResumeRecord->AverageResume));
33+
+ } else {
34+
+ DEBUG ((DEBUG_ERROR, "\nFPDT: S3 ResumeCount reaches the MAX_UINT32 value. S3 ResumeCount record reset to Zero."));
35+
+ }
36+
37+
- DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount = %d\n", AcpiS3ResumeRecord->ResumeCount));
38+
- DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume = %ld\n", AcpiS3ResumeRecord->FullResume));
39+
- DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - AverageResume = %ld\n", AcpiS3ResumeRecord->AverageResume));
40+
+ DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - ResumeCount = 0x%x\n", AcpiS3ResumeRecord->ResumeCount));
41+
+ DEBUG ((DEBUG_INFO, "FPDT: S3 Resume Performance - FullResume = 0x%x\n", AcpiS3ResumeRecord->FullResume));
42+
43+
//
44+
// Update S3 Suspend Performance Record.

‎SPECS/hvloader/hvloader.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: HvLoader.efi is an EFI application for loading an external hypervisor loader.
55
Name: hvloader
66
Version: 1.0.1
7-
Release: 3%{?dist}
7+
Release: 4%{?dist}
88
License: MIT
99
Vendor: Microsoft Corporation
1010
Distribution: Mariner
@@ -14,6 +14,7 @@ Source0: https://github.com/microsoft/HvLoader/archive/refs/tags/v%{versi
1414
# Instructions to generate edk2 submodules: https://github.com/tianocore/edk2/tree/edk2-stable202302?tab=readme-ov-file#submodules
1515
Source1: https://github.com/tianocore/edk2/archive/refs/tags/%{edk2_tag}.tar.gz#/%{edk2_tag}-submodules.tar.gz
1616
Source2: target-x86.txt
17+
Patch0: CVE-2024-1298.patch
1718
BuildRequires: bc
1819
BuildRequires: gcc
1920
BuildRequires: build-essential
@@ -37,6 +38,7 @@ option is the path to hypervisor loader binary.
3738

3839
%prep
3940
%setup -T -a 0 -a 1 -c "%{name}-%{version}"
41+
%patch0 -p1
4042
set -x
4143
ls -l
4244
mv %{name_github}-%{version} MdeModulePkg/Application
@@ -58,6 +60,9 @@ cp ./Build/MdeModule/RELEASE_GCC5/X64/MdeModulePkg/Application/%{name_github}-%{
5860
/boot/efi/HvLoader.efi
5961

6062
%changelog
63+
* Thu Jun 06 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-4
64+
- Add patch to resolve CVE-2024-1298
65+
6166
* Fri May 31 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-3
6267
- Update edk2_tag to edk2-stable202305
6368
- Publish edk2-stable202305-submodules source

0 commit comments

Comments
 (0)