Skip to content

Commit 73a888e

Browse files
[AUTO-CHERRYPICK] Fix CVE-2024-5535 in hvloader - branch main (#11232)
Co-authored-by: joejoew <111843948+joejoew@users.noreply.github.com>
1 parent 4828b0c commit 73a888e

3 files changed

Lines changed: 103 additions & 2 deletions

File tree

SPECS-SIGNED/hvloader-signed/hvloader-signed.spec

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Signed HvLoader.efi for %{buildarch} systems
77
Name: hvloader-signed-%{buildarch}
88
Version: 1.0.1
9-
Release: 5%{?dist}
9+
Release: 6%{?dist}
1010
License: MIT
1111
Vendor: Microsoft Corporation
1212
Distribution: Mariner
@@ -69,6 +69,9 @@ popd
6969
/boot/efi/HvLoader.efi
7070

7171
%changelog
72+
* Mon Nov 25 2024 Zhichun Wan <zhichunwan@microsoft.com> - 1.0.1-6
73+
- Update version for consistency with hvloader spec
74+
7275
* Wed Jun 19 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-5
7376
- Update version for consistency with hvloader spec
7477

SPECS/hvloader/CVE-2024-5535.patch

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
From 7a96ccee7892abe6ee1d8b8b42d293bd5261c2ef Mon Sep 17 00:00:00 2001
2+
From: Zhichun Wan <zhichunwan@microsoft.com>
3+
Date: Tue, 26 Nov 2024 01:49:38 +0000
4+
Subject: [PATCH] patches
5+
6+
---
7+
.../Library/OpensslLib/openssl/ssl/ssl_lib.c | 63 ++++++++++++-------
8+
1 file changed, 40 insertions(+), 23 deletions(-)
9+
10+
diff --git a/CryptoPkg/Library/OpensslLib/openssl/ssl/ssl_lib.c b/CryptoPkg/Library/OpensslLib/openssl/ssl/ssl_lib.c
11+
index 47adc321..0dca8e69 100644
12+
--- a/CryptoPkg/Library/OpensslLib/openssl/ssl/ssl_lib.c
13+
+++ b/CryptoPkg/Library/OpensslLib/openssl/ssl/ssl_lib.c
14+
@@ -2761,37 +2761,54 @@ int SSL_select_next_proto(unsigned char **out, unsigned char *outlen,
15+
unsigned int server_len,
16+
const unsigned char *client, unsigned int client_len)
17+
{
18+
- unsigned int i, j;
19+
- const unsigned char *result;
20+
- int status = OPENSSL_NPN_UNSUPPORTED;
21+
+ PACKET cpkt, csubpkt, spkt, ssubpkt;
22+
+
23+
+ if (!PACKET_buf_init(&cpkt, client, client_len)
24+
+ || !PACKET_get_length_prefixed_1(&cpkt, &csubpkt)
25+
+ || PACKET_remaining(&csubpkt) == 0) {
26+
+ *out = NULL;
27+
+ *outlen = 0;
28+
+ return OPENSSL_NPN_NO_OVERLAP;
29+
+ }
30+
+
31+
+ /*
32+
+ * Set the default opportunistic protocol. Will be overwritten if we find
33+
+ * a match.
34+
+ */
35+
+ *out = (unsigned char *)PACKET_data(&csubpkt);
36+
+ *outlen = (unsigned char)PACKET_remaining(&csubpkt);
37+
38+
/*
39+
* For each protocol in server preference order, see if we support it.
40+
*/
41+
- for (i = 0; i < server_len;) {
42+
- for (j = 0; j < client_len;) {
43+
- if (server[i] == client[j] &&
44+
- memcmp(&server[i + 1], &client[j + 1], server[i]) == 0) {
45+
- /* We found a match */
46+
- result = &server[i];
47+
- status = OPENSSL_NPN_NEGOTIATED;
48+
- goto found;
49+
+ if (PACKET_buf_init(&spkt, server, server_len)) {
50+
+ while (PACKET_get_length_prefixed_1(&spkt, &ssubpkt)) {
51+
+ if (PACKET_remaining(&ssubpkt) == 0)
52+
+ continue; /* Invalid - ignore it */
53+
+ if (PACKET_buf_init(&cpkt, client, client_len)) {
54+
+ while (PACKET_get_length_prefixed_1(&cpkt, &csubpkt)) {
55+
+ if (PACKET_equal(&csubpkt, PACKET_data(&ssubpkt),
56+
+ PACKET_remaining(&ssubpkt))) {
57+
+ /* We found a match */
58+
+ *out = (unsigned char *)PACKET_data(&ssubpkt);
59+
+ *outlen = (unsigned char)PACKET_remaining(&ssubpkt);
60+
+ return OPENSSL_NPN_NEGOTIATED;
61+
+ }
62+
+ }
63+
+ /* Ignore spurious trailing bytes in the client list */
64+
+ } else {
65+
+ /* This should never happen */
66+
+ return OPENSSL_NPN_NO_OVERLAP;
67+
}
68+
- j += client[j];
69+
- j++;
70+
}
71+
- i += server[i];
72+
- i++;
73+
+ /* Ignore spurious trailing bytes in the server list */
74+
}
75+
76+
- /* There's no overlap between our protocols and the server's list. */
77+
- result = client;
78+
- status = OPENSSL_NPN_NO_OVERLAP;
79+
-
80+
- found:
81+
- *out = (unsigned char *)result + 1;
82+
- *outlen = result[0];
83+
- return status;
84+
+ /*
85+
+ * There's no overlap between our protocols and the server's list. We use
86+
+ * the default opportunistic protocol selected earlier
87+
+ */
88+
+ return OPENSSL_NPN_NO_OVERLAP;
89+
}
90+
91+
#ifndef OPENSSL_NO_NEXTPROTONEG
92+
--
93+
2.45.2
94+

SPECS/hvloader/hvloader.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: HvLoader.efi is an EFI application for loading an external hypervisor loader.
55
Name: hvloader
66
Version: 1.0.1
7-
Release: 5%{?dist}
7+
Release: 6%{?dist}
88
License: MIT
99
Vendor: Microsoft Corporation
1010
Distribution: Mariner
@@ -16,6 +16,7 @@ Source1: https://github.com/tianocore/edk2/archive/refs/tags/%{edk2_tag}.
1616
Source2: target-x86.txt
1717
Patch0: CVE-2024-1298.patch
1818
Patch1: CVE-2023-0464.patch
19+
Patch2: CVE-2024-5535.patch
1920
BuildRequires: bc
2021
BuildRequires: gcc
2122
BuildRequires: build-essential
@@ -60,6 +61,9 @@ cp ./Build/MdeModule/RELEASE_GCC5/X64/MdeModulePkg/Application/%{name_github}-%{
6061
/boot/efi/HvLoader.efi
6162

6263
%changelog
64+
* Mon Nov 25 2024 Zhichun Wan <zhichunwan@microsoft.com> - 1.0.1-6
65+
- Add patch to resolve CVE-2024-5535
66+
6367
* Wed Jun 19 2024 Archana Choudhary <archana1@microsoft.com> - 1.0.1-5
6468
- Add patch to resolve CVE-2023-0464
6569

0 commit comments

Comments
 (0)