summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSoumya Sambu <soumya.sambu@windriver.com>2024-08-02 03:34:33 +0000
committerSteve Sakoman <steve@sakoman.com>2024-12-09 07:54:03 -0800
commit4c2d3e37308cac98614dfafed79b7323423af8bc (patch)
tree17bda8fe3760d2faec6f3601bdf257f0d108c33c
parent3a7159d8d87d665cea93e2dc52201eb3dfbc46b9 (diff)
downloadpoky-4c2d3e37308cac98614dfafed79b7323423af8bc.tar.gz
ovmf: Fix CVE-2023-45237
EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. References: https://nvd.nist.gov/vuln/detail/CVE-2023-45237 Upstream-patches: https://github.com/tianocore/edk2/commit/cf07238e5fa4f8b1138ac1c9e80530b4d4e59f1c https://github.com/tianocore/edk2/commit/4c4ceb2ceb80c42fd5545b2a4bd80321f07f4345 (From OE-Core rev: 6f8bdaad9d22e65108f859a695277ce1b20ef7c6) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0001.patch78
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0002.patch1288
-rw-r--r--meta/recipes-core/ovmf/ovmf_git.bb2
3 files changed, 1368 insertions, 0 deletions
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0001.patch b/meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0001.patch
new file mode 100644
index 0000000000..d1dcb8dc44
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0001.patch
@@ -0,0 +1,78 @@
1From cf07238e5fa4f8b1138ac1c9e80530b4d4e59f1c Mon Sep 17 00:00:00 2001
2From: Pierre Gondois <pierre.gondois@arm.com>
3Date: Fri, 11 Aug 2023 16:33:06 +0200
4Subject: [PATCH] MdePkg/Rng: Add GUID to describe Arm Rndr Rng algorithms
5
6BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4441
7
8The EFI_RNG_PROTOCOL can rely on the RngLib. The RngLib has multiple
9implementations, some of them are unsafe (e.g. BaseRngLibTimerLib).
10To allow the RngDxe to detect when such implementation is used,
11a GetRngGuid() function is added in a following patch.
12
13Prepare GetRngGuid() return values and add a gEfiRngAlgorithmArmRndr
14to describe a Rng algorithm accessed through Arm's RNDR instruction.
15[1] states that the implementation of this algorithm should be
16compliant to NIST SP900-80. The compliance is not guaranteed.
17
18[1] Arm Architecture Reference Manual Armv8, for A-profile architecture
19sK12.1 'Properties of the generated random number'
20
21Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
22Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
23Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
24Acked-by: Ard Biesheuvel <ardb@kernel.org>
25Tested-by: Kun Qin <kun.qin@microsoft.com>
26
27CVE: CVE-2023-45237
28
29Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/cf07238e5fa4f8b1138ac1c9e80530b4d4e59f1c]
30
31Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
32---
33 MdePkg/Include/Protocol/Rng.h | 10 ++++++++++
34 MdePkg/MdePkg.dec | 1 +
35 2 files changed, 11 insertions(+)
36
37diff --git a/MdePkg/Include/Protocol/Rng.h b/MdePkg/Include/Protocol/Rng.h
38index baf425587b..38bde53240 100644
39--- a/MdePkg/Include/Protocol/Rng.h
40+++ b/MdePkg/Include/Protocol/Rng.h
41@@ -67,6 +67,15 @@ typedef EFI_GUID EFI_RNG_ALGORITHM;
42 { \
43 0xe43176d7, 0xb6e8, 0x4827, {0xb7, 0x84, 0x7f, 0xfd, 0xc4, 0xb6, 0x85, 0x61 } \
44 }
45+///
46+/// The Arm Architecture states the RNDR that the DRBG algorithm should be compliant
47+/// with NIST SP800-90A, while not mandating a particular algorithm, so as to be
48+/// inclusive of different geographies.
49+///
50+#define EFI_RNG_ALGORITHM_ARM_RNDR \
51+ { \
52+ 0x43d2fde3, 0x9d4e, 0x4d79, {0x02, 0x96, 0xa8, 0x9b, 0xca, 0x78, 0x08, 0x41} \
53+ }
54
55 /**
56 Returns information about the random number generation implementation.
57@@ -146,5 +155,6 @@ extern EFI_GUID gEfiRngAlgorithmSp80090Ctr256Guid;
58 extern EFI_GUID gEfiRngAlgorithmX9313DesGuid;
59 extern EFI_GUID gEfiRngAlgorithmX931AesGuid;
60 extern EFI_GUID gEfiRngAlgorithmRaw;
61+extern EFI_GUID gEfiRngAlgorithmArmRndr;
62
63 #endif
64diff --git a/MdePkg/MdePkg.dec b/MdePkg/MdePkg.dec
65index 59b405928b..a449dbc556 100644
66--- a/MdePkg/MdePkg.dec
67+++ b/MdePkg/MdePkg.dec
68@@ -594,6 +594,7 @@
69 gEfiRngAlgorithmX9313DesGuid = { 0x63c4785a, 0xca34, 0x4012, {0xa3, 0xc8, 0x0b, 0x6a, 0x32, 0x4f, 0x55, 0x46 }}
70 gEfiRngAlgorithmX931AesGuid = { 0xacd03321, 0x777e, 0x4d3d, {0xb1, 0xc8, 0x20, 0xcf, 0xd8, 0x88, 0x20, 0xc9 }}
71 gEfiRngAlgorithmRaw = { 0xe43176d7, 0xb6e8, 0x4827, {0xb7, 0x84, 0x7f, 0xfd, 0xc4, 0xb6, 0x85, 0x61 }}
72+ gEfiRngAlgorithmArmRndr = { 0x43d2fde3, 0x9d4e, 0x4d79, {0x02, 0x96, 0xa8, 0x9b, 0xca, 0x78, 0x08, 0x41 }}
73
74 ## Include/Protocol/AdapterInformation.h
75 gEfiAdapterInfoMediaStateGuid = { 0xD7C74207, 0xA831, 0x4A26, {0xB1, 0xF5, 0xD1, 0x93, 0x06, 0x5C, 0xE8, 0xB6 }}
76--
772.40.0
78
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0002.patch b/meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0002.patch
new file mode 100644
index 0000000000..722a6cd530
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2023-45237-0002.patch
@@ -0,0 +1,1288 @@
1From 4c4ceb2ceb80c42fd5545b2a4bd80321f07f4345 Mon Sep 17 00:00:00 2001
2From: Doug Flick <dougflick@microsoft.com>
3Date: Wed, 8 May 2024 22:56:28 -0700
4Subject: [PATCH] NetworkPkg: SECURITY PATCH CVE-2023-45237
5
6REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4542
7
8Bug Overview:
9PixieFail Bug #9
10CVE-2023-45237
11CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
12CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
13
14Use of a Weak PseudoRandom Number Generator
15
16Change Overview:
17
18Updates all Instances of NET_RANDOM (NetRandomInitSeed ()) to either
19
20>
21> EFI_STATUS
22> EFIAPI
23> PseudoRandomU32 (
24> OUT UINT32 *Output
25> );
26>
27
28or (depending on the use case)
29
30>
31> EFI_STATUS
32> EFIAPI
33> PseudoRandom (
34> OUT VOID *Output,
35> IN UINTN OutputLength
36> );
37>
38
39This is because the use of
40
41Example:
42
43The following code snippet PseudoRandomU32 () function is used:
44
45>
46> UINT32 Random;
47>
48> Status = PseudoRandomU32 (&Random);
49> if (EFI_ERROR (Status)) {
50> DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n",
51__func__, Status));
52> return Status;
53> }
54>
55
56This also introduces a new PCD to enable/disable the use of the
57secure implementation of algorithms for PseudoRandom () and
58instead depend on the default implementation. This may be required for
59some platforms where the UEFI Spec defined algorithms are not available.
60
61>
62> PcdEnforceSecureRngAlgorithms
63>
64
65If the platform does not have any one of the UEFI defined
66secure RNG algorithms then the driver will assert.
67
68Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
69Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
70
71Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
72Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
73
74CVE: CVE-2023-45237
75
76Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/4c4ceb2ceb80c42fd5545b2a4bd80321f07f4345]
77
78Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
79---
80 NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c | 10 +-
81 NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c | 11 +-
82 NetworkPkg/DnsDxe/DnsDhcp.c | 10 +-
83 NetworkPkg/DnsDxe/DnsImpl.c | 11 +-
84 NetworkPkg/HttpBootDxe/HttpBootDhcp6.c | 10 +-
85 NetworkPkg/IScsiDxe/IScsiCHAP.c | 19 ++-
86 NetworkPkg/IScsiDxe/IScsiMisc.c | 14 +--
87 NetworkPkg/IScsiDxe/IScsiMisc.h | 6 +-
88 NetworkPkg/Include/Library/NetLib.h | 40 +++++--
89 NetworkPkg/Ip4Dxe/Ip4Driver.c | 10 +-
90 NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c | 9 +-
91 NetworkPkg/Ip6Dxe/Ip6Driver.c | 17 ++-
92 NetworkPkg/Ip6Dxe/Ip6If.c | 12 +-
93 NetworkPkg/Ip6Dxe/Ip6Mld.c | 12 +-
94 NetworkPkg/Ip6Dxe/Ip6Nd.c | 33 +++++-
95 NetworkPkg/Ip6Dxe/Ip6Nd.h | 8 +-
96 NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 130 ++++++++++++++++++---
97 NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 14 ++-
98 NetworkPkg/NetworkPkg.dec | 7 ++
99 NetworkPkg/SecurityFixes.yaml | 39 +++++++
100 NetworkPkg/TcpDxe/TcpDriver.c | 15 ++-
101 NetworkPkg/TcpDxe/TcpDxe.inf | 3 +
102 NetworkPkg/Udp4Dxe/Udp4Driver.c | 10 +-
103 NetworkPkg/Udp6Dxe/Udp6Driver.c | 11 +-
104 NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c | 9 +-
105 NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c | 11 +-
106 NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c | 12 +-
107 27 files changed, 410 insertions(+), 83 deletions(-)
108
109diff --git a/NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c b/NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c
110index 8c37e93be3..892caee368 100644
111--- a/NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c
112+++ b/NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c
113@@ -1,6 +1,7 @@
114 /** @file
115
116 Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
117+Copyright (c) Microsoft Corporation
118 SPDX-License-Identifier: BSD-2-Clause-Patent
119
120 **/
121@@ -189,6 +190,13 @@ Dhcp4CreateService (
122 {
123 DHCP_SERVICE *DhcpSb;
124 EFI_STATUS Status;
125+ UINT32 Random;
126+
127+ Status = PseudoRandomU32 (&Random);
128+ if (EFI_ERROR (Status)) {
129+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
130+ return Status;
131+ }
132
133 *Service = NULL;
134 DhcpSb = AllocateZeroPool (sizeof (DHCP_SERVICE));
135@@ -203,7 +211,7 @@ Dhcp4CreateService (
136 DhcpSb->Image = ImageHandle;
137 InitializeListHead (&DhcpSb->Children);
138 DhcpSb->DhcpState = Dhcp4Stopped;
139- DhcpSb->Xid = NET_RANDOM (NetRandomInitSeed ());
140+ DhcpSb->Xid = Random;
141 CopyMem (
142 &DhcpSb->ServiceBinding,
143 &mDhcp4ServiceBindingTemplate,
144diff --git a/NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c b/NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c
145index b591a4605b..e7f2787a98 100644
146--- a/NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c
147+++ b/NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c
148@@ -3,7 +3,7 @@
149 implementation for Dhcp6 Driver.
150
151 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
152-
153+ Copyright (c) Microsoft Corporation
154 SPDX-License-Identifier: BSD-2-Clause-Patent
155
156 **/
157@@ -123,6 +123,13 @@ Dhcp6CreateService (
158 {
159 DHCP6_SERVICE *Dhcp6Srv;
160 EFI_STATUS Status;
161+ UINT32 Random;
162+
163+ Status = PseudoRandomU32 (&Random);
164+ if (EFI_ERROR (Status)) {
165+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
166+ return Status;
167+ }
168
169 *Service = NULL;
170 Dhcp6Srv = AllocateZeroPool (sizeof (DHCP6_SERVICE));
171@@ -147,7 +154,7 @@ Dhcp6CreateService (
172 Dhcp6Srv->Signature = DHCP6_SERVICE_SIGNATURE;
173 Dhcp6Srv->Controller = Controller;
174 Dhcp6Srv->Image = ImageHandle;
175- Dhcp6Srv->Xid = (0xffffff & NET_RANDOM (NetRandomInitSeed ()));
176+ Dhcp6Srv->Xid = (0xffffff & Random);
177
178 CopyMem (
179 &Dhcp6Srv->ServiceBinding,
180diff --git a/NetworkPkg/DnsDxe/DnsDhcp.c b/NetworkPkg/DnsDxe/DnsDhcp.c
181index 933565a32d..9eb3c1d2d8 100644
182--- a/NetworkPkg/DnsDxe/DnsDhcp.c
183+++ b/NetworkPkg/DnsDxe/DnsDhcp.c
184@@ -2,6 +2,7 @@
185 Functions implementation related with DHCPv4/v6 for DNS driver.
186
187 Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
188+Copyright (c) Microsoft Corporation
189 SPDX-License-Identifier: BSD-2-Clause-Patent
190
191 **/
192@@ -277,6 +278,7 @@ GetDns4ServerFromDhcp4 (
193 EFI_DHCP4_TRANSMIT_RECEIVE_TOKEN Token;
194 BOOLEAN IsDone;
195 UINTN Index;
196+ UINT32 Random;
197
198 Image = Instance->Service->ImageHandle;
199 Controller = Instance->Service->ControllerHandle;
200@@ -292,6 +294,12 @@ GetDns4ServerFromDhcp4 (
201 Data = NULL;
202 InterfaceInfo = NULL;
203
204+ Status = PseudoRandomU32 (&Random);
205+ if (EFI_ERROR (Status)) {
206+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
207+ return Status;
208+ }
209+
210 ZeroMem ((UINT8 *)ParaList, sizeof (ParaList));
211
212 ZeroMem (&MnpConfigData, sizeof (EFI_MANAGED_NETWORK_CONFIG_DATA));
213@@ -467,7 +475,7 @@ GetDns4ServerFromDhcp4 (
214
215 Status = Dhcp4->Build (Dhcp4, &SeedPacket, 0, NULL, 2, ParaList, &Token.Packet);
216
217- Token.Packet->Dhcp4.Header.Xid = HTONL (NET_RANDOM (NetRandomInitSeed ()));
218+ Token.Packet->Dhcp4.Header.Xid = Random;
219
220 Token.Packet->Dhcp4.Header.Reserved = HTONS ((UINT16)0x8000);
221
222diff --git a/NetworkPkg/DnsDxe/DnsImpl.c b/NetworkPkg/DnsDxe/DnsImpl.c
223index d311812800..c2629bb8df 100644
224--- a/NetworkPkg/DnsDxe/DnsImpl.c
225+++ b/NetworkPkg/DnsDxe/DnsImpl.c
226@@ -2,6 +2,7 @@
227 DnsDxe support functions implementation.
228
229 Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>
230+Copyright (c) Microsoft Corporation
231 SPDX-License-Identifier: BSD-2-Clause-Patent
232
233 **/
234@@ -1963,6 +1964,14 @@ ConstructDNSQuery (
235 NET_FRAGMENT Frag;
236 DNS_HEADER *DnsHeader;
237 DNS_QUERY_SECTION *DnsQuery;
238+ EFI_STATUS Status;
239+ UINT32 Random;
240+
241+ Status = PseudoRandomU32 (&Random);
242+ if (EFI_ERROR (Status)) {
243+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
244+ return Status;
245+ }
246
247 //
248 // Messages carried by UDP are restricted to 512 bytes (not counting the IP
249@@ -1977,7 +1986,7 @@ ConstructDNSQuery (
250 // Fill header
251 //
252 DnsHeader = (DNS_HEADER *)Frag.Bulk;
253- DnsHeader->Identification = (UINT16)NET_RANDOM (NetRandomInitSeed ());
254+ DnsHeader->Identification = (UINT16)Random;
255 DnsHeader->Flags.Uint16 = 0x0000;
256 DnsHeader->Flags.Bits.RD = 1;
257 DnsHeader->Flags.Bits.OpCode = DNS_FLAGS_OPCODE_STANDARD;
258diff --git a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
259index b22cef4ff5..f964515b0f 100644
260--- a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
261+++ b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
262@@ -2,6 +2,7 @@
263 Functions implementation related with DHCPv6 for HTTP boot driver.
264
265 Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
266+Copyright (c) Microsoft Corporation
267 SPDX-License-Identifier: BSD-2-Clause-Patent
268
269 **/
270@@ -951,6 +952,7 @@ HttpBootDhcp6Sarr (
271 UINT32 OptCount;
272 UINT8 Buffer[HTTP_BOOT_DHCP6_OPTION_MAX_SIZE];
273 EFI_STATUS Status;
274+ UINT32 Random;
275
276 Dhcp6 = Private->Dhcp6;
277 ASSERT (Dhcp6 != NULL);
278@@ -961,6 +963,12 @@ HttpBootDhcp6Sarr (
279 OptCount = HttpBootBuildDhcp6Options (Private, OptList, Buffer);
280 ASSERT (OptCount > 0);
281
282+ Status = PseudoRandomU32 (&Random);
283+ if (EFI_ERROR (Status)) {
284+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
285+ return Status;
286+ }
287+
288 Retransmit = AllocateZeroPool (sizeof (EFI_DHCP6_RETRANSMISSION));
289 if (Retransmit == NULL) {
290 return EFI_OUT_OF_RESOURCES;
291@@ -976,7 +984,7 @@ HttpBootDhcp6Sarr (
292 Config.IaInfoEvent = NULL;
293 Config.RapidCommit = FALSE;
294 Config.ReconfigureAccept = FALSE;
295- Config.IaDescriptor.IaId = NET_RANDOM (NetRandomInitSeed ());
296+ Config.IaDescriptor.IaId = Random;
297 Config.IaDescriptor.Type = EFI_DHCP6_IA_TYPE_NA;
298 Config.SolicitRetransmission = Retransmit;
299 Retransmit->Irt = 4;
300diff --git a/NetworkPkg/IScsiDxe/IScsiCHAP.c b/NetworkPkg/IScsiDxe/IScsiCHAP.c
301index b507f11cd4..bebb1ac29b 100644
302--- a/NetworkPkg/IScsiDxe/IScsiCHAP.c
303+++ b/NetworkPkg/IScsiDxe/IScsiCHAP.c
304@@ -3,6 +3,7 @@
305 Configuration.
306
307 Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
308+Copyright (c) Microsoft Corporation
309 SPDX-License-Identifier: BSD-2-Clause-Patent
310
311 **/
312@@ -576,16 +577,24 @@ IScsiCHAPToSendReq (
313 //
314 // CHAP_I=<I>
315 //
316- IScsiGenRandom ((UINT8 *)&AuthData->OutIdentifier, 1);
317+ Status = IScsiGenRandom ((UINT8 *)&AuthData->OutIdentifier, 1);
318+ if (EFI_ERROR (Status)) {
319+ break;
320+ }
321+
322 AsciiSPrint (ValueStr, sizeof (ValueStr), "%d", AuthData->OutIdentifier);
323 IScsiAddKeyValuePair (Pdu, ISCSI_KEY_CHAP_IDENTIFIER, ValueStr);
324 //
325 // CHAP_C=<C>
326 //
327- IScsiGenRandom (
328- (UINT8 *)AuthData->OutChallenge,
329- AuthData->Hash->DigestSize
330- );
331+ Status = IScsiGenRandom (
332+ (UINT8 *)AuthData->OutChallenge,
333+ AuthData->Hash->DigestSize
334+ );
335+ if (EFI_ERROR (Status)) {
336+ break;
337+ }
338+
339 BinToHexStatus = IScsiBinToHex (
340 (UINT8 *)AuthData->OutChallenge,
341 AuthData->Hash->DigestSize,
342diff --git a/NetworkPkg/IScsiDxe/IScsiMisc.c b/NetworkPkg/IScsiDxe/IScsiMisc.c
343index b3ea90158f..cd77f1a13e 100644
344--- a/NetworkPkg/IScsiDxe/IScsiMisc.c
345+++ b/NetworkPkg/IScsiDxe/IScsiMisc.c
346@@ -2,6 +2,7 @@
347 Miscellaneous routines for iSCSI driver.
348
349 Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
350+Copyright (c) Microsoft Corporation
351 SPDX-License-Identifier: BSD-2-Clause-Patent
352
353 **/
354@@ -474,20 +475,17 @@ IScsiNetNtoi (
355 @param[in, out] Rand The buffer to contain random numbers.
356 @param[in] RandLength The length of the Rand buffer.
357
358+ @retval EFI_SUCCESS on success
359+ @retval others on error
360+
361 **/
362-VOID
363+EFI_STATUS
364 IScsiGenRandom (
365 IN OUT UINT8 *Rand,
366 IN UINTN RandLength
367 )
368 {
369- UINT32 Random;
370-
371- while (RandLength > 0) {
372- Random = NET_RANDOM (NetRandomInitSeed ());
373- *Rand++ = (UINT8)(Random);
374- RandLength--;
375- }
376+ return PseudoRandom (Rand, RandLength);
377 }
378
379 /**
380diff --git a/NetworkPkg/IScsiDxe/IScsiMisc.h b/NetworkPkg/IScsiDxe/IScsiMisc.h
381index a951eee70e..91b2cd2261 100644
382--- a/NetworkPkg/IScsiDxe/IScsiMisc.h
383+++ b/NetworkPkg/IScsiDxe/IScsiMisc.h
384@@ -2,6 +2,7 @@
385 Miscellaneous definitions for iSCSI driver.
386
387 Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
388+Copyright (c) Microsoft Corporation
389 SPDX-License-Identifier: BSD-2-Clause-Patent
390
391 **/
392@@ -202,8 +203,11 @@ IScsiNetNtoi (
393 @param[in, out] Rand The buffer to contain random numbers.
394 @param[in] RandLength The length of the Rand buffer.
395
396+ @retval EFI_SUCCESS on success
397+ @retval others on error
398+
399 **/
400-VOID
401+EFI_STATUS
402 IScsiGenRandom (
403 IN OUT UINT8 *Rand,
404 IN UINTN RandLength
405diff --git a/NetworkPkg/Include/Library/NetLib.h b/NetworkPkg/Include/Library/NetLib.h
406index 8c0e62b388..e8108b79db 100644
407--- a/NetworkPkg/Include/Library/NetLib.h
408+++ b/NetworkPkg/Include/Library/NetLib.h
409@@ -3,6 +3,7 @@
410 It provides basic functions for the UEFI network stack.
411
412 Copyright (c) 2005 - 2018, Intel Corporation. All rights reserved.<BR>
413+Copyright (c) Microsoft Corporation
414 SPDX-License-Identifier: BSD-2-Clause-Patent
415
416 **/
417@@ -539,8 +540,6 @@ extern EFI_IPv4_ADDRESS mZeroIp4Addr;
418 #define TICKS_PER_MS 10000U
419 #define TICKS_PER_SECOND 10000000U
420
421-#define NET_RANDOM(Seed) ((UINT32) ((UINT32) (Seed) * 1103515245UL + 12345) % 4294967295UL)
422-
423 /**
424 Extract a UINT32 from a byte stream.
425
426@@ -580,19 +579,40 @@ NetPutUint32 (
427 );
428
429 /**
430- Initialize a random seed using current time and monotonic count.
431+ Generate a Random output data given a length.
432
433- Get current time and monotonic count first. Then initialize a random seed
434- based on some basic mathematics operation on the hour, day, minute, second,
435- nanosecond and year of the current time and the monotonic count value.
436+ @param[out] Output - The buffer to store the generated random data.
437+ @param[in] OutputLength - The length of the output buffer.
438
439- @return The random seed initialized with current time.
440+ @retval EFI_SUCCESS On Success
441+ @retval EFI_INVALID_PARAMETER Pointer is null or size is zero
442+ @retval EFI_NOT_FOUND RNG protocol not found
443+ @retval Others Error from RngProtocol->GetRNG()
444
445+ @return Status code
446 **/
447-UINT32
448+EFI_STATUS
449 EFIAPI
450-NetRandomInitSeed (
451- VOID
452+PseudoRandom (
453+ OUT VOID *Output,
454+ IN UINTN OutputLength
455+ );
456+
457+/**
458+ Generate a 32-bit pseudo-random number.
459+
460+ @param[out] Output - The buffer to store the generated random number.
461+
462+ @retval EFI_SUCCESS On Success
463+ @retval EFI_NOT_FOUND RNG protocol not found
464+ @retval Others Error from RngProtocol->GetRNG()
465+
466+ @return Status code
467+**/
468+EFI_STATUS
469+EFIAPI
470+PseudoRandomU32 (
471+ OUT UINT32 *Output
472 );
473
474 #define NET_LIST_USER_STRUCT(Entry, Type, Field) \
475diff --git a/NetworkPkg/Ip4Dxe/Ip4Driver.c b/NetworkPkg/Ip4Dxe/Ip4Driver.c
476index ec483ff01f..683423f38d 100644
477--- a/NetworkPkg/Ip4Dxe/Ip4Driver.c
478+++ b/NetworkPkg/Ip4Dxe/Ip4Driver.c
479@@ -2,6 +2,7 @@
480 The driver binding and service binding protocol for IP4 driver.
481
482 Copyright (c) 2005 - 2019, Intel Corporation. All rights reserved.<BR>
483+Copyright (c) Microsoft Corporation
484 (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
485
486 SPDX-License-Identifier: BSD-2-Clause-Patent
487@@ -549,11 +550,18 @@ Ip4DriverBindingStart (
488 EFI_IP4_CONFIG2_PROTOCOL *Ip4Cfg2;
489 UINTN Index;
490 IP4_CONFIG2_DATA_ITEM *DataItem;
491+ UINT32 Random;
492
493 IpSb = NULL;
494 Ip4Cfg2 = NULL;
495 DataItem = NULL;
496
497+ Status = PseudoRandomU32 (&Random);
498+ if (EFI_ERROR (Status)) {
499+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
500+ return Status;
501+ }
502+
503 //
504 // Test for the Ip4 service binding protocol
505 //
506@@ -653,7 +661,7 @@ Ip4DriverBindingStart (
507 //
508 // Initialize the IP4 ID
509 //
510- mIp4Id = (UINT16)NET_RANDOM (NetRandomInitSeed ());
511+ mIp4Id = (UINT16)Random;
512
513 return Status;
514
515diff --git a/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c b/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
516index 70e232ce6c..4c1354d26c 100644
517--- a/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
518+++ b/NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
519@@ -2276,6 +2276,13 @@ Ip6ConfigInitInstance (
520 UINTN Index;
521 UINT16 IfIndex;
522 IP6_CONFIG_DATA_ITEM *DataItem;
523+ UINT32 Random;
524+
525+ Status = PseudoRandomU32 (&Random);
526+ if (EFI_ERROR (Status)) {
527+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
528+ return Status;
529+ }
530
531 IpSb = IP6_SERVICE_FROM_IP6_CONFIG_INSTANCE (Instance);
532
533@@ -2381,7 +2388,7 @@ Ip6ConfigInitInstance (
534 // The NV variable is not set, so generate a random IAID, and write down the
535 // fresh new configuration as the NV variable now.
536 //
537- Instance->IaId = NET_RANDOM (NetRandomInitSeed ());
538+ Instance->IaId = Random;
539
540 for (Index = 0; Index < IpSb->SnpMode.HwAddressSize; Index++) {
541 Instance->IaId |= (IpSb->SnpMode.CurrentAddress.Addr[Index] << ((Index << 3) & 31));
542diff --git a/NetworkPkg/Ip6Dxe/Ip6Driver.c b/NetworkPkg/Ip6Dxe/Ip6Driver.c
543index b483a7d136..cbe011dad4 100644
544--- a/NetworkPkg/Ip6Dxe/Ip6Driver.c
545+++ b/NetworkPkg/Ip6Dxe/Ip6Driver.c
546@@ -3,7 +3,7 @@
547
548 Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>
549 (C) Copyright 2015 Hewlett-Packard Development Company, L.P.<BR>
550-
551+ Copyright (c) Microsoft Corporation
552 SPDX-License-Identifier: BSD-2-Clause-Patent
553
554 **/
555@@ -316,7 +316,11 @@ Ip6CreateService (
556 IpSb->CurHopLimit = IP6_HOP_LIMIT;
557 IpSb->LinkMTU = IP6_MIN_LINK_MTU;
558 IpSb->BaseReachableTime = IP6_REACHABLE_TIME;
559- Ip6UpdateReachableTime (IpSb);
560+ Status = Ip6UpdateReachableTime (IpSb);
561+ if (EFI_ERROR (Status)) {
562+ goto ON_ERROR;
563+ }
564+
565 //
566 // RFC4861 RETRANS_TIMER: 1,000 milliseconds
567 //
568@@ -516,11 +520,18 @@ Ip6DriverBindingStart (
569 EFI_STATUS Status;
570 EFI_IP6_CONFIG_PROTOCOL *Ip6Cfg;
571 IP6_CONFIG_DATA_ITEM *DataItem;
572+ UINT32 Random;
573
574 IpSb = NULL;
575 Ip6Cfg = NULL;
576 DataItem = NULL;
577
578+ Status = PseudoRandomU32 (&Random);
579+ if (EFI_ERROR (Status)) {
580+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
581+ return Status;
582+ }
583+
584 //
585 // Test for the Ip6 service binding protocol
586 //
587@@ -656,7 +667,7 @@ Ip6DriverBindingStart (
588 //
589 // Initialize the IP6 ID
590 //
591- mIp6Id = NET_RANDOM (NetRandomInitSeed ());
592+ mIp6Id = Random;
593
594 return EFI_SUCCESS;
595
596diff --git a/NetworkPkg/Ip6Dxe/Ip6If.c b/NetworkPkg/Ip6Dxe/Ip6If.c
597index 4629c05f25..f3d11c4d21 100644
598--- a/NetworkPkg/Ip6Dxe/Ip6If.c
599+++ b/NetworkPkg/Ip6Dxe/Ip6If.c
600@@ -2,7 +2,7 @@
601 Implement IP6 pseudo interface.
602
603 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
604-
605+ Copyright (c) Microsoft Corporation
606 SPDX-License-Identifier: BSD-2-Clause-Patent
607
608 **/
609@@ -89,6 +89,14 @@ Ip6SetAddress (
610 IP6_PREFIX_LIST_ENTRY *PrefixEntry;
611 UINT64 Delay;
612 IP6_DELAY_JOIN_LIST *DelayNode;
613+ EFI_STATUS Status;
614+ UINT32 Random;
615+
616+ Status = PseudoRandomU32 (&Random);
617+ if (EFI_ERROR (Status)) {
618+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
619+ return Status;
620+ }
621
622 NET_CHECK_SIGNATURE (Interface, IP6_INTERFACE_SIGNATURE);
623
624@@ -164,7 +172,7 @@ Ip6SetAddress (
625 // Thus queue the address to be processed in Duplicate Address Detection module
626 // after the delay time (in milliseconds).
627 //
628- Delay = (UINT64)NET_RANDOM (NetRandomInitSeed ());
629+ Delay = (UINT64)Random;
630 Delay = MultU64x32 (Delay, IP6_ONE_SECOND_IN_MS);
631 Delay = RShiftU64 (Delay, 32);
632
633diff --git a/NetworkPkg/Ip6Dxe/Ip6Mld.c b/NetworkPkg/Ip6Dxe/Ip6Mld.c
634index e6b2b653e2..498a118543 100644
635--- a/NetworkPkg/Ip6Dxe/Ip6Mld.c
636+++ b/NetworkPkg/Ip6Dxe/Ip6Mld.c
637@@ -696,7 +696,15 @@ Ip6UpdateDelayTimer (
638 IN OUT IP6_MLD_GROUP *Group
639 )
640 {
641- UINT32 Delay;
642+ UINT32 Delay;
643+ EFI_STATUS Status;
644+ UINT32 Random;
645+
646+ Status = PseudoRandomU32 (&Random);
647+ if (EFI_ERROR (Status)) {
648+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
649+ return Status;
650+ }
651
652 //
653 // If the Query packet specifies a Maximum Response Delay of zero, perform timer
654@@ -715,7 +723,7 @@ Ip6UpdateDelayTimer (
655 // is less than the remaining value of the running timer.
656 //
657 if ((Group->DelayTimer == 0) || (Delay < Group->DelayTimer)) {
658- Group->DelayTimer = Delay / 4294967295UL * NET_RANDOM (NetRandomInitSeed ());
659+ Group->DelayTimer = Delay / 4294967295UL * Random;
660 }
661
662 return EFI_SUCCESS;
663diff --git a/NetworkPkg/Ip6Dxe/Ip6Nd.c b/NetworkPkg/Ip6Dxe/Ip6Nd.c
664index c10c7017f8..72aa45c10f 100644
665--- a/NetworkPkg/Ip6Dxe/Ip6Nd.c
666+++ b/NetworkPkg/Ip6Dxe/Ip6Nd.c
667@@ -2,7 +2,7 @@
668 Implementation of Neighbor Discovery support routines.
669
670 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
671-
672+ Copyright (c) Microsoft Corporation
673 SPDX-License-Identifier: BSD-2-Clause-Patent
674
675 **/
676@@ -16,17 +16,28 @@ EFI_MAC_ADDRESS mZeroMacAddress;
677
678 @param[in, out] IpSb Points to the IP6_SERVICE.
679
680+ @retval EFI_SUCCESS ReachableTime Updated
681+ @retval others Failed to update ReachableTime
682 **/
683-VOID
684+EFI_STATUS
685 Ip6UpdateReachableTime (
686 IN OUT IP6_SERVICE *IpSb
687 )
688 {
689- UINT32 Random;
690+ UINT32 Random;
691+ EFI_STATUS Status;
692
693- Random = (NetRandomInitSeed () / 4294967295UL) * IP6_RANDOM_FACTOR_SCALE;
694+ Status = PseudoRandomU32 (&Random);
695+ if (EFI_ERROR (Status)) {
696+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
697+ return Status;
698+ }
699+
700+ Random = (Random / 4294967295UL) * IP6_RANDOM_FACTOR_SCALE;
701 Random = Random + IP6_MIN_RANDOM_FACTOR_SCALED;
702 IpSb->ReachableTime = (IpSb->BaseReachableTime * Random) / IP6_RANDOM_FACTOR_SCALE;
703+
704+ return EFI_SUCCESS;
705 }
706
707 /**
708@@ -972,10 +983,17 @@ Ip6InitDADProcess (
709 IP6_SERVICE *IpSb;
710 EFI_STATUS Status;
711 UINT32 MaxDelayTick;
712+ UINT32 Random;
713
714 NET_CHECK_SIGNATURE (IpIf, IP6_INTERFACE_SIGNATURE);
715 ASSERT (AddressInfo != NULL);
716
717+ Status = PseudoRandomU32 (&Random);
718+ if (EFI_ERROR (Status)) {
719+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
720+ return Status;
721+ }
722+
723 //
724 // Do nothing if we have already started DAD on the address.
725 //
726@@ -1014,7 +1032,7 @@ Ip6InitDADProcess (
727 Entry->Transmit = 0;
728 Entry->Receive = 0;
729 MaxDelayTick = IP6_MAX_RTR_SOLICITATION_DELAY / IP6_TIMER_INTERVAL_IN_MS;
730- Entry->RetransTick = (MaxDelayTick * ((NET_RANDOM (NetRandomInitSeed ()) % 5) + 1)) / 5;
731+ Entry->RetransTick = (MaxDelayTick * ((Random % 5) + 1)) / 5;
732 Entry->AddressInfo = AddressInfo;
733 Entry->Callback = Callback;
734 Entry->Context = Context;
735@@ -2078,7 +2096,10 @@ Ip6ProcessRouterAdvertise (
736 // in BaseReachableTime and recompute a ReachableTime.
737 //
738 IpSb->BaseReachableTime = ReachableTime;
739- Ip6UpdateReachableTime (IpSb);
740+ Status = Ip6UpdateReachableTime (IpSb);
741+ if (EFI_ERROR (Status)) {
742+ goto Exit;
743+ }
744 }
745
746 if (RetransTimer != 0) {
747diff --git a/NetworkPkg/Ip6Dxe/Ip6Nd.h b/NetworkPkg/Ip6Dxe/Ip6Nd.h
748index bf64e9114e..5795e23c7d 100644
749--- a/NetworkPkg/Ip6Dxe/Ip6Nd.h
750+++ b/NetworkPkg/Ip6Dxe/Ip6Nd.h
751@@ -2,7 +2,7 @@
752 Definition of Neighbor Discovery support routines.
753
754 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
755-
756+ Copyright (c) Microsoft Corporation
757 SPDX-License-Identifier: BSD-2-Clause-Patent
758
759 **/
760@@ -780,10 +780,10 @@ Ip6OnArpResolved (
761 /**
762 Update the ReachableTime in IP6 service binding instance data, in milliseconds.
763
764- @param[in, out] IpSb Points to the IP6_SERVICE.
765-
766+ @retval EFI_SUCCESS ReachableTime Updated
767+ @retval others Failed to update ReachableTime
768 **/
769-VOID
770+EFI_STATUS
771 Ip6UpdateReachableTime (
772 IN OUT IP6_SERVICE *IpSb
773 );
774diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
775index fd4a9e15a8..01c13c08d2 100644
776--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
777+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
778@@ -3,6 +3,7 @@
779
780 Copyright (c) 2005 - 2018, Intel Corporation. All rights reserved.<BR>
781 (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
782+Copyright (c) Microsoft Corporation
783 SPDX-License-Identifier: BSD-2-Clause-Patent
784 **/
785
786@@ -31,6 +32,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
787 #include <Library/DevicePathLib.h>
788 #include <Library/PrintLib.h>
789 #include <Library/UefiLib.h>
790+#include <Protocol/Rng.h>
791
792 #define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
793 #define DEFAULT_ZERO_START ((UINTN) ~0)
794@@ -127,6 +129,25 @@ GLOBAL_REMOVE_IF_UNREFERENCED VLAN_DEVICE_PATH mNetVlanDevicePathTemplate = {
795 0
796 };
797
798+//
799+// These represent UEFI SPEC defined algorithms that should be supported by
800+// the RNG protocol and are generally considered secure.
801+//
802+// The order of the algorithms in this array is important. This order is the order
803+// in which the algorithms will be tried by the RNG protocol.
804+// If your platform needs to use a specific algorithm for the random number generator,
805+// then you should place that algorithm first in the array.
806+//
807+GLOBAL_REMOVE_IF_UNREFERENCED EFI_GUID *mSecureHashAlgorithms[] = {
808+ &gEfiRngAlgorithmSp80090Ctr256Guid, // SP800-90A DRBG CTR using AES-256
809+ &gEfiRngAlgorithmSp80090Hmac256Guid, // SP800-90A DRBG HMAC using SHA-256
810+ &gEfiRngAlgorithmSp80090Hash256Guid, // SP800-90A DRBG Hash using SHA-256
811+ &gEfiRngAlgorithmArmRndr, // unspecified SP800-90A DRBG via ARM RNDR register
812+ &gEfiRngAlgorithmRaw, // Raw data from NRBG (or TRNG)
813+};
814+
815+#define SECURE_HASH_ALGORITHMS_SIZE (sizeof (mSecureHashAlgorithms) / sizeof (EFI_GUID *))
816+
817 /**
818 Locate the handles that support SNP, then open one of them
819 to send the syslog packets. The caller isn't required to close
820@@ -884,34 +905,107 @@ Ip6Swap128 (
821 }
822
823 /**
824- Initialize a random seed using current time and monotonic count.
825+ Generate a Random output data given a length.
826
827- Get current time and monotonic count first. Then initialize a random seed
828- based on some basic mathematics operation on the hour, day, minute, second,
829- nanosecond and year of the current time and the monotonic count value.
830+ @param[out] Output - The buffer to store the generated random data.
831+ @param[in] OutputLength - The length of the output buffer.
832
833- @return The random seed initialized with current time.
834+ @retval EFI_SUCCESS On Success
835+ @retval EFI_INVALID_PARAMETER Pointer is null or size is zero
836+ @retval EFI_NOT_FOUND RNG protocol not found
837+ @retval Others Error from RngProtocol->GetRNG()
838
839+ @return Status code
840 **/
841-UINT32
842+EFI_STATUS
843 EFIAPI
844-NetRandomInitSeed (
845- VOID
846+PseudoRandom (
847+ OUT VOID *Output,
848+ IN UINTN OutputLength
849 )
850 {
851- EFI_TIME Time;
852- UINT32 Seed;
853- UINT64 MonotonicCount;
854+ EFI_RNG_PROTOCOL *RngProtocol;
855+ EFI_STATUS Status;
856+ UINTN AlgorithmIndex;
857+
858+ if ((Output == NULL) || (OutputLength == 0)) {
859+ return EFI_INVALID_PARAMETER;
860+ }
861+
862+ Status = gBS->LocateProtocol (&gEfiRngProtocolGuid, NULL, (VOID **)&RngProtocol);
863+ if (EFI_ERROR (Status)) {
864+ DEBUG ((DEBUG_ERROR, "Failed to locate EFI_RNG_PROTOCOL: %r\n", Status));
865+ ASSERT_EFI_ERROR (Status);
866+ return Status;
867+ }
868+
869+ if (PcdGetBool (PcdEnforceSecureRngAlgorithms)) {
870+ for (AlgorithmIndex = 0; AlgorithmIndex < SECURE_HASH_ALGORITHMS_SIZE; AlgorithmIndex++) {
871+ Status = RngProtocol->GetRNG (RngProtocol, mSecureHashAlgorithms[AlgorithmIndex], OutputLength, (UINT8 *)Output);
872+ if (!EFI_ERROR (Status)) {
873+ //
874+ // Secure Algorithm was supported on this platform
875+ //
876+ return EFI_SUCCESS;
877+ } else if (Status == EFI_UNSUPPORTED) {
878+ //
879+ // Secure Algorithm was not supported on this platform
880+ //
881+ DEBUG ((DEBUG_ERROR, "Failed to generate random data using secure algorithm %d: %r\n", AlgorithmIndex, Status));
882+
883+ //
884+ // Try the next secure algorithm
885+ //
886+ continue;
887+ } else {
888+ //
889+ // Some other error occurred
890+ //
891+ DEBUG ((DEBUG_ERROR, "Failed to generate random data using secure algorithm %d: %r\n", AlgorithmIndex, Status));
892+ ASSERT_EFI_ERROR (Status);
893+ return Status;
894+ }
895+ }
896+
897+ //
898+ // If we get here, we failed to generate random data using any secure algorithm
899+ // Platform owner should ensure that at least one secure algorithm is supported
900+ //
901+ ASSERT_EFI_ERROR (Status);
902+ return Status;
903+ }
904+
905+ //
906+ // Lets try using the default algorithm (which may not be secure)
907+ //
908+ Status = RngProtocol->GetRNG (RngProtocol, NULL, OutputLength, (UINT8 *)Output);
909+ if (EFI_ERROR (Status)) {
910+ DEBUG ((DEBUG_ERROR, "%a failed to generate random data: %r\n", __func__, Status));
911+ ASSERT_EFI_ERROR (Status);
912+ return Status;
913+ }
914
915- gRT->GetTime (&Time, NULL);
916- Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 | Time.Second);
917- Seed ^= Time.Nanosecond;
918- Seed ^= Time.Year << 7;
919+ return EFI_SUCCESS;
920+}
921+
922+/**
923+ Generate a 32-bit pseudo-random number.
924
925- gBS->GetNextMonotonicCount (&MonotonicCount);
926- Seed += (UINT32)MonotonicCount;
927+ @param[out] Output - The buffer to store the generated random number.
928
929- return Seed;
930+ @retval EFI_SUCCESS On Success
931+ @retval EFI_NOT_FOUND RNG protocol not found
932+ @retval Others Error from RngProtocol->GetRNG()
933+
934+ @return Status code
935+**/
936+EFI_STATUS
937+EFIAPI
938+PseudoRandomU32 (
939+ OUT UINT32 *Output
940+ )
941+{
942+ return PseudoRandom (Output, sizeof (*Output));
943 }
944
945 /**
946diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
947index 8145d256ec..a8f534a293 100644
948--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
949+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
950@@ -3,6 +3,7 @@
951 #
952 # Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
953 # (C) Copyright 2015 Hewlett Packard Enterprise Development LP<BR>
954+# Copyright (c) Microsoft Corporation
955 # SPDX-License-Identifier: BSD-2-Clause-Patent
956 #
957 ##
958@@ -49,7 +50,11 @@
959 gEfiSmbiosTableGuid ## SOMETIMES_CONSUMES ## SystemTable
960 gEfiSmbios3TableGuid ## SOMETIMES_CONSUMES ## SystemTable
961 gEfiAdapterInfoMediaStateGuid ## SOMETIMES_CONSUMES
962-
963+ gEfiRngAlgorithmRaw ## CONSUMES
964+ gEfiRngAlgorithmSp80090Ctr256Guid ## CONSUMES
965+ gEfiRngAlgorithmSp80090Hmac256Guid ## CONSUMES
966+ gEfiRngAlgorithmSp80090Hash256Guid ## CONSUMES
967+ gEfiRngAlgorithmArmRndr ## CONSUMES
968
969 [Protocols]
970 gEfiSimpleNetworkProtocolGuid ## SOMETIMES_CONSUMES
971@@ -59,3 +64,10 @@
972 gEfiComponentNameProtocolGuid ## SOMETIMES_CONSUMES
973 gEfiComponentName2ProtocolGuid ## SOMETIMES_CONSUMES
974 gEfiAdapterInformationProtocolGuid ## SOMETIMES_CONSUMES
975+ gEfiRngProtocolGuid ## CONSUMES
976+
977+[FixedPcd]
978+ gEfiNetworkPkgTokenSpaceGuid.PcdEnforceSecureRngAlgorithms ## CONSUMES
979+
980+[Depex]
981+ gEfiRngProtocolGuid
982diff --git a/NetworkPkg/NetworkPkg.dec b/NetworkPkg/NetworkPkg.dec
983index 928e84fec4..ff335e957c 100644
984--- a/NetworkPkg/NetworkPkg.dec
985+++ b/NetworkPkg/NetworkPkg.dec
986@@ -5,6 +5,7 @@
987 #
988 # Copyright (c) 2009 - 2021, Intel Corporation. All rights reserved.<BR>
989 # (C) Copyright 2015-2020 Hewlett Packard Enterprise Development LP<BR>
990+# Copyright (c) Microsoft Corporation
991 #
992 # SPDX-License-Identifier: BSD-2-Clause-Patent
993 #
994@@ -127,6 +128,12 @@
995 # @Prompt Indicates whether SnpDxe creates event for ExitBootServices() call.
996 gEfiNetworkPkgTokenSpaceGuid.PcdSnpCreateExitBootServicesEvent|TRUE|BOOLEAN|0x1000000C
997
998+ ## Enforces the use of Secure UEFI spec defined RNG algorithms for all network connections.
999+ # TRUE - Enforce the use of Secure UEFI spec defined RNG algorithms.
1000+ # FALSE - Do not enforce and depend on the default implementation of RNG algorithm from the provider.
1001+ # @Prompt Enforce the use of Secure UEFI spec defined RNG algorithms.
1002+ gEfiNetworkPkgTokenSpaceGuid.PcdEnforceSecureRngAlgorithms|TRUE|BOOLEAN|0x1000000D
1003+
1004 [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]
1005 ## IPv6 DHCP Unique Identifier (DUID) Type configuration (From RFCs 3315 and 6355).
1006 # 01 = DUID Based on Link-layer Address Plus Time [DUID-LLT]
1007diff --git a/NetworkPkg/SecurityFixes.yaml b/NetworkPkg/SecurityFixes.yaml
1008index 7e900483fe..2b2c794697 100644
1009--- a/NetworkPkg/SecurityFixes.yaml
1010+++ b/NetworkPkg/SecurityFixes.yaml
1011@@ -121,3 +121,42 @@ CVE_2023_45235:
1012 - http://www.openwall.com/lists/oss-security/2024/01/16/2
1013 - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
1014 - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
1015+CVE_2023_45237:
1016+ commit_titles:
1017+ - "NetworkPkg:: SECURITY PATCH CVE 2023-45237"
1018+ cve: CVE-2023-45237
1019+ date_reported: 2023-08-28 13:56 UTC
1020+ description: "Bug 09 - Use of a Weak PseudoRandom Number Generator"
1021+ note:
1022+ files_impacted:
1023+ - NetworkPkg/Dhcp4Dxe/Dhcp4Driver.c
1024+ - NetworkPkg/Dhcp6Dxe/Dhcp6Driver.c
1025+ - NetworkPkg/DnsDxe/DnsDhcp.c
1026+ - NetworkPkg/DnsDxe/DnsImpl.c
1027+ - NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
1028+ - NetworkPkg/IScsiDxe/IScsiCHAP.c
1029+ - NetworkPkg/IScsiDxe/IScsiMisc.c
1030+ - NetworkPkg/IScsiDxe/IScsiMisc.h
1031+ - NetworkPkg/Include/Library/NetLib.h
1032+ - NetworkPkg/Ip4Dxe/Ip4Driver.c
1033+ - NetworkPkg/Ip6Dxe/Ip6ConfigImpl.c
1034+ - NetworkPkg/Ip6Dxe/Ip6Driver.c
1035+ - NetworkPkg/Ip6Dxe/Ip6If.c
1036+ - NetworkPkg/Ip6Dxe/Ip6Mld.c
1037+ - NetworkPkg/Ip6Dxe/Ip6Nd.c
1038+ - NetworkPkg/Ip6Dxe/Ip6Nd.h
1039+ - NetworkPkg/Library/DxeNetLib/DxeNetLib.c
1040+ - NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
1041+ - NetworkPkg/NetworkPkg.dec
1042+ - NetworkPkg/TcpDxe/TcpDriver.c
1043+ - NetworkPkg/Udp4Dxe/Udp4Driver.c
1044+ - NetworkPkg/Udp6Dxe/Udp6Driver.c
1045+ - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
1046+ - NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
1047+ - NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c
1048+ links:
1049+ - https://bugzilla.tianocore.org/show_bug.cgi?id=4542
1050+ - https://nvd.nist.gov/vuln/detail/CVE-2023-45237
1051+ - http://www.openwall.com/lists/oss-security/2024/01/16/2
1052+ - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.html
1053+ - https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
1054diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c
1055index 98a90e0210..8fe6badd68 100644
1056--- a/NetworkPkg/TcpDxe/TcpDriver.c
1057+++ b/NetworkPkg/TcpDxe/TcpDriver.c
1058@@ -2,7 +2,7 @@
1059 The driver binding and service binding protocol for the TCP driver.
1060
1061 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
1062-
1063+ Copyright (c) Microsoft Corporation
1064 SPDX-License-Identifier: BSD-2-Clause-Patent
1065
1066 **/
1067@@ -163,7 +163,13 @@ TcpDriverEntryPoint (
1068 )
1069 {
1070 EFI_STATUS Status;
1071- UINT32 Seed;
1072+ UINT32 Random;
1073+
1074+ Status = PseudoRandomU32 (&Random);
1075+ if (EFI_ERROR (Status)) {
1076+ DEBUG ((DEBUG_ERROR, "%a Failed to generate random number: %r\n", __func__, Status));
1077+ return Status;
1078+ }
1079
1080 //
1081 // Install the TCP Driver Binding Protocol
1082@@ -203,9 +209,8 @@ TcpDriverEntryPoint (
1083 //
1084 // Initialize ISS and random port.
1085 //
1086- Seed = NetRandomInitSeed ();
1087- mTcpGlobalIss = NET_RANDOM (Seed) % mTcpGlobalIss;
1088- mTcp4RandomPort = (UINT16)(TCP_PORT_KNOWN + (NET_RANDOM (Seed) % TCP_PORT_KNOWN));
1089+ mTcpGlobalIss = Random % mTcpGlobalIss;
1090+ mTcp4RandomPort = (UINT16)(TCP_PORT_KNOWN + (Random % TCP_PORT_KNOWN));
1091 mTcp6RandomPort = mTcp4RandomPort;
1092
1093 return EFI_SUCCESS;
1094diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf b/NetworkPkg/TcpDxe/TcpDxe.inf
1095index c0acbdca57..cf5423f4c5 100644
1096--- a/NetworkPkg/TcpDxe/TcpDxe.inf
1097+++ b/NetworkPkg/TcpDxe/TcpDxe.inf
1098@@ -82,5 +82,8 @@
1099 gEfiTcp6ProtocolGuid ## BY_START
1100 gEfiTcp6ServiceBindingProtocolGuid ## BY_START
1101
1102+[Depex]
1103+ gEfiHash2ServiceBindingProtocolGuid
1104+
1105 [UserExtensions.TianoCore."ExtraFiles"]
1106 TcpDxeExtra.uni
1107diff --git a/NetworkPkg/Udp4Dxe/Udp4Driver.c b/NetworkPkg/Udp4Dxe/Udp4Driver.c
1108index cb917fcfc9..c7ea16f4cd 100644
1109--- a/NetworkPkg/Udp4Dxe/Udp4Driver.c
1110+++ b/NetworkPkg/Udp4Dxe/Udp4Driver.c
1111@@ -1,6 +1,7 @@
1112 /** @file
1113
1114 Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>
1115+Copyright (c) Microsoft Corporation
1116 SPDX-License-Identifier: BSD-2-Clause-Patent
1117
1118 **/
1119@@ -555,6 +556,13 @@ Udp4DriverEntryPoint (
1120 )
1121 {
1122 EFI_STATUS Status;
1123+ UINT32 Random;
1124+
1125+ Status = PseudoRandomU32 (&Random);
1126+ if (EFI_ERROR (Status)) {
1127+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
1128+ return Status;
1129+ }
1130
1131 //
1132 // Install the Udp4DriverBinding and Udp4ComponentName protocols.
1133@@ -571,7 +579,7 @@ Udp4DriverEntryPoint (
1134 //
1135 // Initialize the UDP random port.
1136 //
1137- mUdp4RandomPort = (UINT16)(((UINT16)NetRandomInitSeed ()) % UDP4_PORT_KNOWN + UDP4_PORT_KNOWN);
1138+ mUdp4RandomPort = (UINT16)(((UINT16)Random) % UDP4_PORT_KNOWN + UDP4_PORT_KNOWN);
1139 }
1140
1141 return Status;
1142diff --git a/NetworkPkg/Udp6Dxe/Udp6Driver.c b/NetworkPkg/Udp6Dxe/Udp6Driver.c
1143index ae96fb9966..edb758d57c 100644
1144--- a/NetworkPkg/Udp6Dxe/Udp6Driver.c
1145+++ b/NetworkPkg/Udp6Dxe/Udp6Driver.c
1146@@ -2,7 +2,7 @@
1147 Driver Binding functions and Service Binding functions for the Network driver module.
1148
1149 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
1150-
1151+ Copyright (c) Microsoft Corporation
1152 SPDX-License-Identifier: BSD-2-Clause-Patent
1153
1154 **/
1155@@ -596,6 +596,13 @@ Udp6DriverEntryPoint (
1156 )
1157 {
1158 EFI_STATUS Status;
1159+ UINT32 Random;
1160+
1161+ Status = PseudoRandomU32 (&Random);
1162+ if (EFI_ERROR (Status)) {
1163+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
1164+ return Status;
1165+ }
1166
1167 //
1168 // Install the Udp6DriverBinding and Udp6ComponentName protocols.
1169@@ -614,7 +621,7 @@ Udp6DriverEntryPoint (
1170 // Initialize the UDP random port.
1171 //
1172 mUdp6RandomPort = (UINT16)(
1173- ((UINT16)NetRandomInitSeed ()) %
1174+ ((UINT16)Random) %
1175 UDP6_PORT_KNOWN +
1176 UDP6_PORT_KNOWN
1177 );
1178diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
1179index 91146b78cb..452038c219 100644
1180--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
1181+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp4.c
1182@@ -2,7 +2,7 @@
1183 Functions implementation related with DHCPv4 for UefiPxeBc Driver.
1184
1185 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
1186-
1187+ Copyright (c) Microsoft Corporation
1188 SPDX-License-Identifier: BSD-2-Clause-Patent
1189
1190 **/
1191@@ -1381,6 +1381,12 @@ PxeBcDhcp4Discover (
1192 UINT8 VendorOptLen;
1193 UINT32 Xid;
1194
1195+ Status = PseudoRandomU32 (&Xid);
1196+ if (EFI_ERROR (Status)) {
1197+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
1198+ return Status;
1199+ }
1200+
1201 Mode = Private->PxeBc.Mode;
1202 Dhcp4 = Private->Dhcp4;
1203 Status = EFI_SUCCESS;
1204@@ -1471,7 +1477,6 @@ PxeBcDhcp4Discover (
1205 //
1206 // Set fields of the token for the request packet.
1207 //
1208- Xid = NET_RANDOM (NetRandomInitSeed ());
1209 Token.Packet->Dhcp4.Header.Xid = HTONL (Xid);
1210 Token.Packet->Dhcp4.Header.Reserved = HTONS ((UINT16)((IsBCast) ? 0x8000 : 0x0));
1211 CopyMem (&Token.Packet->Dhcp4.Header.ClientAddr, &Private->StationIp, sizeof (EFI_IPv4_ADDRESS));
1212diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
1213index 7fd1281c11..bcabbd2219 100644
1214--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
1215+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDhcp6.c
1216@@ -2180,7 +2180,7 @@ PxeBcDhcp6Discover (
1217 UINTN ReadSize;
1218 UINT16 OpCode;
1219 UINT16 OpLen;
1220- UINT32 Xid;
1221+ UINT32 Random;
1222 EFI_STATUS Status;
1223 UINTN DiscoverLenNeeded;
1224
1225@@ -2198,6 +2198,12 @@ PxeBcDhcp6Discover (
1226 return EFI_DEVICE_ERROR;
1227 }
1228
1229+ Status = PseudoRandomU32 (&Random);
1230+ if (EFI_ERROR (Status)) {
1231+ DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));
1232+ return Status;
1233+ }
1234+
1235 DiscoverLenNeeded = sizeof (EFI_PXE_BASE_CODE_DHCPV6_PACKET);
1236 Discover = AllocateZeroPool (DiscoverLenNeeded);
1237 if (Discover == NULL) {
1238@@ -2207,8 +2213,7 @@ PxeBcDhcp6Discover (
1239 //
1240 // Build the discover packet by the cached request packet before.
1241 //
1242- Xid = NET_RANDOM (NetRandomInitSeed ());
1243- Discover->TransactionId = HTONL (Xid);
1244+ Discover->TransactionId = HTONL (Random);
1245 Discover->MessageType = Request->Dhcp6.Header.MessageType;
1246 RequestOpt = Request->Dhcp6.Option;
1247 DiscoverOpt = Discover->DhcpOptions;
1248diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c b/NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c
1249index d84aca7e85..4cd915b411 100644
1250--- a/NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c
1251+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcDriver.c
1252@@ -3,6 +3,7 @@
1253
1254 (C) Copyright 2014 Hewlett-Packard Development Company, L.P.<BR>
1255 Copyright (c) 2007 - 2019, Intel Corporation. All rights reserved.<BR>
1256+ Copyright (c) Microsoft Corporation
1257
1258 SPDX-License-Identifier: BSD-2-Clause-Patent
1259
1260@@ -892,6 +893,13 @@ PxeBcCreateIp6Children (
1261 PXEBC_PRIVATE_PROTOCOL *Id;
1262 EFI_SIMPLE_NETWORK_PROTOCOL *Snp;
1263 UINTN Index;
1264+ UINT32 Random;
1265+
1266+ Status = PseudoRandomU32 (&Random);
1267+ if (EFI_ERROR (Status)) {
1268+ DEBUG ((DEBUG_ERROR, "Failed to generate random number using EFI_RNG_PROTOCOL: %r\n", Status));
1269+ return Status;
1270+ }
1271
1272 if (Private->Ip6Nic != NULL) {
1273 //
1274@@ -935,9 +943,9 @@ PxeBcCreateIp6Children (
1275 }
1276
1277 //
1278- // Generate a random IAID for the Dhcp6 assigned address.
1279+ // Set a random IAID for the Dhcp6 assigned address.
1280 //
1281- Private->IaId = NET_RANDOM (NetRandomInitSeed ());
1282+ Private->IaId = Random;
1283 if (Private->Snp != NULL) {
1284 for (Index = 0; Index < Private->Snp->Mode->HwAddressSize; Index++) {
1285 Private->IaId |= (Private->Snp->Mode->CurrentAddress.Addr[Index] << ((Index << 3) & 31));
1286--
12872.40.0
1288
diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb
index 6ac72772d1..47ed2c7cd3 100644
--- a/meta/recipes-core/ovmf/ovmf_git.bb
+++ b/meta/recipes-core/ovmf/ovmf_git.bb
@@ -47,6 +47,8 @@ SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \
47 file://CVE-2023-45229-0002.patch \ 47 file://CVE-2023-45229-0002.patch \
48 file://CVE-2023-45229-0003.patch \ 48 file://CVE-2023-45229-0003.patch \
49 file://CVE-2023-45229-0004.patch \ 49 file://CVE-2023-45229-0004.patch \
50 file://CVE-2023-45237-0001.patch \
51 file://CVE-2023-45237-0002.patch \
50 " 52 "
51 53
52PV = "edk2-stable202202" 54PV = "edk2-stable202202"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-10 17:00:23 +0000