summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSoumya Sambu <soumya.sambu@windriver.com>2024-06-28 09:04:54 +0000
committerSteve Sakoman <steve@sakoman.com>2024-12-09 07:54:03 -0800
commit9bd68aeb6678c60833965aa3d5bd31a7cef3d45c (patch)
treea754217ee647284dff806168fb0fc62130956371
parent8975a92de5dc34e4fb6a2842acb3482ebe1fbd1c (diff)
downloadpoky-9bd68aeb6678c60833965aa3d5bd31a7cef3d45c.tar.gz
ovmf: Fix CVE-2023-45231
EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality. References: https://nvd.nist.gov/vuln/detail/CVE-2023-45231 Upstream-patches: https://github.com/tianocore/edk2/commit/bbfee34f4188ac00371abe1389ae9c9fb989a0cd https://github.com/tianocore/edk2/commit/6f77463d72807ec7f4ed6518c3dac29a1040df9f (From OE-Core rev: bdff14d8e6f4dad7b873442c813672ef0ec6fb01) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0001.patch65
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0002.patch250
-rw-r--r--meta/recipes-core/ovmf/ovmf_git.bb2
3 files changed, 317 insertions, 0 deletions
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0001.patch b/meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0001.patch
new file mode 100644
index 0000000000..7aa9b27407
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0001.patch
@@ -0,0 +1,65 @@
1From bbfee34f4188ac00371abe1389ae9c9fb989a0cd Mon Sep 17 00:00:00 2001
2From: Doug Flick <dougflick@microsoft.com>
3Date: Fri, 26 Jan 2024 05:54:48 +0800
4Subject: [PATCH] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Patch
5
6REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536
7
8Bug Overview:
9PixieFail Bug #3
10CVE-2023-45231
11CVSS 6.5 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
12CWE-125 Out-of-bounds Read
13
14Out-of-bounds read when handling a ND Redirect message with truncated
15options
16
17Change Overview:
18
19Adds a check to prevent truncated options from being parsed
20+ //
21+ // Cannot process truncated options.
22+ // Cannot process options with a length of 0 as there is no Type
23field.
24+ //
25+ if (OptionLen < sizeof (IP6_OPTION_HEADER)) {
26+ return FALSE;
27+ }
28
29Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
30Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
31
32Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
33Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
34
35CVE: CVE-2023-45231
36
37Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/bbfee34f4188ac00371abe1389ae9c9fb989a0cd]
38
39Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
40---
41 NetworkPkg/Ip6Dxe/Ip6Option.c | 8 ++++++++
42 1 file changed, 8 insertions(+)
43
44diff --git a/NetworkPkg/Ip6Dxe/Ip6Option.c b/NetworkPkg/Ip6Dxe/Ip6Option.c
45index 199eea124d..8718d5d875 100644
46--- a/NetworkPkg/Ip6Dxe/Ip6Option.c
47+++ b/NetworkPkg/Ip6Dxe/Ip6Option.c
48@@ -137,6 +137,14 @@ Ip6IsNDOptionValid (
49 return FALSE;
50 }
51
52+ //
53+ // Cannot process truncated options.
54+ // Cannot process options with a length of 0 as there is no Type field.
55+ //
56+ if (OptionLen < sizeof (IP6_OPTION_HEADER)) {
57+ return FALSE;
58+ }
59+
60 Offset = 0;
61
62 //
63--
642.40.0
65
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0002.patch b/meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0002.patch
new file mode 100644
index 0000000000..fbc2c4416e
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2023-45231-0002.patch
@@ -0,0 +1,250 @@
1From 6f77463d72807ec7f4ed6518c3dac29a1040df9f Mon Sep 17 00:00:00 2001
2From: Doug Flick <dougflick@microsoft.com>
3Date: Fri, 26 Jan 2024 05:54:49 +0800
4Subject: [PATCH] NetworkPkg: Ip6Dxe: SECURITY PATCH CVE-2023-45231 Unit Tests
5
6REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4536
7
8Validates that the patch for...
9
10Out-of-bounds read when handling a ND Redirect message with truncated
11options
12
13.. has been fixed
14
15Tests the following function to ensure that an out of bounds read does
16not occur
17Ip6OptionValidation
18
19Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
20Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
21
22Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
23Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
24
25CVE: CVE-2023-45231
26
27Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/6f77463d72807ec7f4ed6518c3dac29a1040df9f]
28
29Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
30---
31 .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp | 20 +++
32 .../Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf | 42 ++++++
33 .../Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp | 129 ++++++++++++++++++
34 3 files changed, 191 insertions(+)
35 create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
36 create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
37 create mode 100644 NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
38
39diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
40new file mode 100644
41index 0000000000..6ebfd5fdfb
42--- /dev/null
43+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.cpp
44@@ -0,0 +1,20 @@
45+/** @file
46+ Acts as the main entry point for the tests for the Ip6Dxe module.
47+
48+ Copyright (c) Microsoft Corporation
49+ SPDX-License-Identifier: BSD-2-Clause-Patent
50+**/
51+#include <gtest/gtest.h>
52+
53+////////////////////////////////////////////////////////////////////////////////
54+// Run the tests
55+////////////////////////////////////////////////////////////////////////////////
56+int
57+main (
58+ int argc,
59+ char *argv[]
60+ )
61+{
62+ testing::InitGoogleTest (&argc, argv);
63+ return RUN_ALL_TESTS ();
64+}
65diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
66new file mode 100644
67index 0000000000..6e4de0745f
68--- /dev/null
69+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6DxeGoogleTest.inf
70@@ -0,0 +1,42 @@
71+## @file
72+# Unit test suite for the Ip6Dxe using Google Test
73+#
74+# Copyright (c) Microsoft Corporation.<BR>
75+# SPDX-License-Identifier: BSD-2-Clause-Patent
76+##
77+[Defines]
78+ INF_VERSION = 0x00010017
79+ BASE_NAME = Ip6DxeUnitTest
80+ FILE_GUID = 4F05D17D-D3E7-4AAE-820C-576D46D2D34A
81+ VERSION_STRING = 1.0
82+ MODULE_TYPE = HOST_APPLICATION
83+#
84+# The following information is for reference only and not required by the build tools.
85+#
86+# VALID_ARCHITECTURES = IA32 X64 AARCH64
87+#
88+[Sources]
89+ Ip6DxeGoogleTest.cpp
90+ Ip6OptionGoogleTest.cpp
91+ ../Ip6Option.c
92+
93+[Packages]
94+ MdePkg/MdePkg.dec
95+ MdeModulePkg/MdeModulePkg.dec
96+ UnitTestFrameworkPkg/UnitTestFrameworkPkg.dec
97+ NetworkPkg/NetworkPkg.dec
98+
99+[LibraryClasses]
100+ GoogleTestLib
101+ DebugLib
102+ NetLib
103+ PcdLib
104+
105+[Protocols]
106+ gEfiDhcp6ServiceBindingProtocolGuid
107+
108+[Pcd]
109+ gEfiNetworkPkgTokenSpaceGuid.PcdDhcp6UidType
110+
111+[Guids]
112+ gZeroGuid
113diff --git a/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
114new file mode 100644
115index 0000000000..f2cd90e1a9
116--- /dev/null
117+++ b/NetworkPkg/Ip6Dxe/GoogleTest/Ip6OptionGoogleTest.cpp
118@@ -0,0 +1,129 @@
119+/** @file
120+ Tests for Ip6Option.c.
121+
122+ Copyright (c) Microsoft Corporation
123+ SPDX-License-Identifier: BSD-2-Clause-Patent
124+**/
125+#include <gtest/gtest.h>
126+
127+extern "C" {
128+ #include <Uefi.h>
129+ #include <Library/BaseLib.h>
130+ #include <Library/DebugLib.h>
131+ #include "../Ip6Impl.h"
132+ #include "../Ip6Option.h"
133+}
134+
135+/////////////////////////////////////////////////////////////////////////
136+// Defines
137+///////////////////////////////////////////////////////////////////////
138+
139+#define IP6_PREFIX_INFO_OPTION_DATA_LEN 32
140+#define OPTION_HEADER_IP6_PREFIX_DATA_LEN (sizeof (IP6_OPTION_HEADER) + IP6_PREFIX_INFO_OPTION_DATA_LEN)
141+
142+////////////////////////////////////////////////////////////////////////
143+// Symbol Definitions
144+// These functions are not directly under test - but required to compile
145+////////////////////////////////////////////////////////////////////////
146+UINT32 mIp6Id;
147+
148+EFI_STATUS
149+Ip6SendIcmpError (
150+ IN IP6_SERVICE *IpSb,
151+ IN NET_BUF *Packet,
152+ IN EFI_IPv6_ADDRESS *SourceAddress OPTIONAL,
153+ IN EFI_IPv6_ADDRESS *DestinationAddress,
154+ IN UINT8 Type,
155+ IN UINT8 Code,
156+ IN UINT32 *Pointer OPTIONAL
157+ )
158+{
159+ // ..
160+ return EFI_SUCCESS;
161+}
162+
163+////////////////////////////////////////////////////////////////////////
164+// Ip6OptionValidation Tests
165+////////////////////////////////////////////////////////////////////////
166+
167+// Define a fixture for your tests if needed
168+class Ip6OptionValidationTest : public ::testing::Test {
169+protected:
170+ // Add any setup code if needed
171+ virtual void
172+ SetUp (
173+ )
174+ {
175+ // Initialize any resources or variables
176+ }
177+
178+ // Add any cleanup code if needed
179+ virtual void
180+ TearDown (
181+ )
182+ {
183+ // Clean up any resources or variables
184+ }
185+};
186+
187+// Test Description:
188+// Null option should return false
189+TEST_F (Ip6OptionValidationTest, NullOptionShouldReturnFalse) {
190+ UINT8 *option = nullptr;
191+ UINT16 optionLen = 10; // Provide a suitable length
192+
193+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
194+}
195+
196+// Test Description:
197+// Truncated option should return false
198+TEST_F (Ip6OptionValidationTest, TruncatedOptionShouldReturnFalse) {
199+ UINT8 option[] = { 0x01 }; // Provide a truncated option
200+ UINT16 optionLen = 1;
201+
202+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
203+}
204+
205+// Test Description:
206+// Ip6OptionPrefixInfo Option with zero length should return false
207+TEST_F (Ip6OptionValidationTest, OptionWithZeroLengthShouldReturnFalse) {
208+ IP6_OPTION_HEADER optionHeader;
209+
210+ optionHeader.Type = Ip6OptionPrefixInfo;
211+ optionHeader.Length = 0;
212+ UINT8 option[sizeof (IP6_OPTION_HEADER)];
213+
214+ CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
215+ UINT16 optionLen = sizeof (IP6_OPTION_HEADER);
216+
217+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
218+}
219+
220+// Test Description:
221+// Ip6OptionPrefixInfo Option with valid length should return true
222+TEST_F (Ip6OptionValidationTest, ValidPrefixInfoOptionShouldReturnTrue) {
223+ IP6_OPTION_HEADER optionHeader;
224+
225+ optionHeader.Type = Ip6OptionPrefixInfo;
226+ optionHeader.Length = 4; // Length 4 * 8 = 32
227+ UINT8 option[OPTION_HEADER_IP6_PREFIX_DATA_LEN];
228+
229+ CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
230+
231+ EXPECT_TRUE (Ip6IsNDOptionValid (option, IP6_PREFIX_INFO_OPTION_DATA_LEN));
232+}
233+
234+// Test Description:
235+// Ip6OptionPrefixInfo Option with invalid length should return false
236+TEST_F (Ip6OptionValidationTest, InvalidPrefixInfoOptionLengthShouldReturnFalse) {
237+ IP6_OPTION_HEADER optionHeader;
238+
239+ optionHeader.Type = Ip6OptionPrefixInfo;
240+ optionHeader.Length = 3; // Length 3 * 8 = 24 (Invalid)
241+ UINT8 option[sizeof (IP6_OPTION_HEADER)];
242+
243+ CopyMem (option, &optionHeader, sizeof (IP6_OPTION_HEADER));
244+ UINT16 optionLen = sizeof (IP6_OPTION_HEADER);
245+
246+ EXPECT_FALSE (Ip6IsNDOptionValid (option, optionLen));
247+}
248--
2492.40.0
250
diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb
index 957a74aabe..e46b3ddebe 100644
--- a/meta/recipes-core/ovmf/ovmf_git.bb
+++ b/meta/recipes-core/ovmf/ovmf_git.bb
@@ -35,6 +35,8 @@ SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \
35 file://CVE-2022-36764-0003.patch \ 35 file://CVE-2022-36764-0003.patch \
36 file://CVE-2023-45230-0001.patch \ 36 file://CVE-2023-45230-0001.patch \
37 file://CVE-2023-45230-0002.patch \ 37 file://CVE-2023-45230-0002.patch \
38 file://CVE-2023-45231-0001.patch \
39 file://CVE-2023-45231-0002.patch \
38 " 40 "
39 41
40PV = "edk2-stable202202" 42PV = "edk2-stable202202"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-06-03 19:14:57 +0000