summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSoumya Sambu <soumya.sambu@windriver.com>2024-06-28 08:45:11 +0000
committerSteve Sakoman <steve@sakoman.com>2024-12-09 07:54:02 -0800
commitde62335badbd1481b9d5944ee05fd257b1fb9de4 (patch)
treee9e48927744d32c6941860562137a6973fdc8231
parentecf0eb5229631497429dbbc91d885b93a94c38c9 (diff)
downloadpoky-de62335badbd1481b9d5944ee05fd257b1fb9de4.tar.gz
ovmf: Fix CVE-2022-36764
EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability. References: https://nvd.nist.gov/vuln/detail/CVE-2022-36764 Upstream-patches: https://github.com/tianocore/edk2/commit/c7b27944218130cca3bbb20314ba5b88b5de4aa4 https://github.com/tianocore/edk2/commit/0d341c01eeabe0ab5e76693b36e728b8f538a40e https://github.com/tianocore/edk2/commit/8f6d343ae639fba8e4b80e45257275e23083431f (From OE-Core rev: aba14824159e549fd77cb90e3a9a327c527b366f) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0001.patch271
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0002.patch281
-rw-r--r--meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0003.patch48
-rw-r--r--meta/recipes-core/ovmf/ovmf_git.bb3
4 files changed, 603 insertions, 0 deletions
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0001.patch b/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0001.patch
new file mode 100644
index 0000000000..a552f36b2c
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0001.patch
@@ -0,0 +1,271 @@
1From c7b27944218130cca3bbb20314ba5b88b5de4aa4 Mon Sep 17 00:00:00 2001
2From: "Douglas Flick [MSFT]" <doug.edk2@gmail.com>
3Date: Fri, 12 Jan 2024 02:16:04 +0800
4Subject: [PATCH] SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE
5 2022-36764
6
7This commit contains the patch files and tests for DxeTpm2MeasureBootLib
8CVE 2022-36764.
9
10Cc: Jiewen Yao <jiewen.yao@intel.com>
11
12Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
13Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
14
15CVE: CVE-2022-36764
16
17Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/c7b27944218130cca3bbb20314ba5b88b5de4aa4]
18
19Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
20---
21 .../DxeTpm2MeasureBootLib.c | 12 ++--
22 .../DxeTpm2MeasureBootLibSanitization.c | 46 +++++++++++++-
23 .../DxeTpm2MeasureBootLibSanitization.h | 28 ++++++++-
24 .../DxeTpm2MeasureBootLibSanitizationTest.c | 60 ++++++++++++++++---
25 4 files changed, 131 insertions(+), 15 deletions(-)
26
27diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
28index 0475103d6e..714cc8e03e 100644
29--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
30+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
31@@ -378,7 +378,6 @@ Exit:
32 @retval EFI_OUT_OF_RESOURCES No enough resource to measure image.
33 @retval EFI_UNSUPPORTED ImageType is unsupported or PE image is mal-format.
34 @retval other error value
35-
36 **/
37 EFI_STATUS
38 EFIAPI
39@@ -405,6 +404,7 @@ Tcg2MeasurePeImage (
40 Status = EFI_UNSUPPORTED;
41 ImageLoad = NULL;
42 EventPtr = NULL;
43+ Tcg2Event = NULL;
44
45 Tcg2Protocol = MeasureBootProtocols->Tcg2Protocol;
46 CcProtocol = MeasureBootProtocols->CcProtocol;
47@@ -420,18 +420,22 @@ Tcg2MeasurePeImage (
48 }
49
50 FilePathSize = (UINT32)GetDevicePathSize (FilePath);
51+ Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
52+ if (EFI_ERROR (Status)) {
53+ return EFI_UNSUPPORTED;
54+ }
55
56 //
57 // Determine destination PCR by BootPolicy
58 //
59- EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
60- EventPtr = AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event));
61+ // from a malicious GPT disk partition
62+ EventPtr = AllocateZeroPool (EventSize);
63 if (EventPtr == NULL) {
64 return EFI_OUT_OF_RESOURCES;
65 }
66
67 Tcg2Event = (EFI_TCG2_EVENT *)EventPtr;
68- Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event);
69+ Tcg2Event->Size = EventSize;
70 Tcg2Event->Header.HeaderSize = sizeof (EFI_TCG2_EVENT_HEADER);
71 Tcg2Event->Header.HeaderVersion = EFI_TCG2_EVENT_HEADER_VERSION;
72 ImageLoad = (EFI_IMAGE_LOAD_EVENT *)Tcg2Event->Event;
73diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
74index e2309655d3..2a4d52c6d5 100644
75--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
76+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.c
77@@ -151,7 +151,7 @@ SanitizeEfiPartitionTableHeader (
78 }
79
80 /**
81- This function will validate that the allocation size from the primary header is sane
82+ This function will validate that the allocation size from the primary header is sane
83 It will check the following:
84 - AllocationSize does not overflow
85
86@@ -273,3 +273,47 @@ SanitizePrimaryHeaderGptEventSize (
87
88 return EFI_SUCCESS;
89 }
90+
91+/**
92+ This function will validate that the PeImage Event Size from the loaded image is sane
93+ It will check the following:
94+ - EventSize does not overflow
95+
96+ @param[in] FilePathSize - Size of the file path.
97+ @param[out] EventSize - Pointer to the event size.
98+
99+ @retval EFI_SUCCESS
100+ The event size is valid.
101+
102+ @retval EFI_OUT_OF_RESOURCES
103+ Overflow would have occurred.
104+
105+ @retval EFI_INVALID_PARAMETER
106+ One of the passed parameters was invalid.
107+**/
108+EFI_STATUS
109+SanitizePeImageEventSize (
110+ IN UINT32 FilePathSize,
111+ OUT UINT32 *EventSize
112+ )
113+{
114+ EFI_STATUS Status;
115+
116+ // Replacing logic:
117+ // sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
118+ Status = SafeUint32Add (OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath), FilePathSize, EventSize);
119+ if (EFI_ERROR (Status)) {
120+ DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
121+ return EFI_BAD_BUFFER_SIZE;
122+ }
123+
124+ // Replacing logic:
125+ // EventSize + sizeof (EFI_TCG2_EVENT) - sizeof (Tcg2Event->Event)
126+ Status = SafeUint32Add (*EventSize, OFFSET_OF (EFI_TCG2_EVENT, Event), EventSize);
127+ if (EFI_ERROR (Status)) {
128+ DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
129+ return EFI_BAD_BUFFER_SIZE;
130+ }
131+
132+ return EFI_SUCCESS;
133+}
134diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
135index 048b738987..8f72ba4240 100644
136--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
137+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLibSanitization.h
138@@ -9,6 +9,9 @@
139 Tcg2MeasureGptTable() function will receive untrusted GPT partition table, and parse
140 partition data carefully.
141
142+ Tcg2MeasurePeImage() function will accept untrusted PE/COFF image and validate its
143+ data structure within this image buffer before use.
144+
145 Copyright (c) Microsoft Corporation.<BR>
146 SPDX-License-Identifier: BSD-2-Clause-Patent
147
148@@ -110,4 +113,27 @@ SanitizePrimaryHeaderGptEventSize (
149 OUT UINT32 *EventSize
150 );
151
152-#endif // DXE_TPM2_MEASURE_BOOT_LIB_SANITATION_
153+/**
154+ This function will validate that the PeImage Event Size from the loaded image is sane
155+ It will check the following:
156+ - EventSize does not overflow
157+
158+ @param[in] FilePathSize - Size of the file path.
159+ @param[out] EventSize - Pointer to the event size.
160+
161+ @retval EFI_SUCCESS
162+ The event size is valid.
163+
164+ @retval EFI_OUT_OF_RESOURCES
165+ Overflow would have occurred.
166+
167+ @retval EFI_INVALID_PARAMETER
168+ One of the passed parameters was invalid.
169+**/
170+EFI_STATUS
171+SanitizePeImageEventSize (
172+ IN UINT32 FilePathSize,
173+ OUT UINT32 *EventSize
174+ );
175+
176+#endif // DXE_TPM2_MEASURE_BOOT_LIB_VALIDATION_
177diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
178index 3eb9763e3c..820e99aeb9 100644
179--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
180+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/InternalUnitTest/DxeTpm2MeasureBootLibSanitizationTest.c
181@@ -72,10 +72,10 @@ TestSanitizeEfiPartitionTableHeader (
182 PrimaryHeader.Header.Revision = DEFAULT_PRIMARY_TABLE_HEADER_REVISION;
183 PrimaryHeader.Header.HeaderSize = sizeof (EFI_PARTITION_TABLE_HEADER);
184 PrimaryHeader.MyLBA = 1;
185- PrimaryHeader.AlternateLBA = 2;
186- PrimaryHeader.FirstUsableLBA = 3;
187- PrimaryHeader.LastUsableLBA = 4;
188- PrimaryHeader.PartitionEntryLBA = 5;
189+ PrimaryHeader.PartitionEntryLBA = 2;
190+ PrimaryHeader.AlternateLBA = 3;
191+ PrimaryHeader.FirstUsableLBA = 4;
192+ PrimaryHeader.LastUsableLBA = 5;
193 PrimaryHeader.NumberOfPartitionEntries = DEFAULT_PRIMARY_TABLE_HEADER_NUMBER_OF_PARTITION_ENTRIES;
194 PrimaryHeader.SizeOfPartitionEntry = DEFAULT_PRIMARY_TABLE_HEADER_SIZE_OF_PARTITION_ENTRY;
195 PrimaryHeader.PartitionEntryArrayCRC32 = 0; // Purposely invalid
196@@ -187,11 +187,6 @@ TestSanitizePrimaryHeaderGptEventSize (
197 EFI_STATUS Status;
198 EFI_PARTITION_TABLE_HEADER PrimaryHeader;
199 UINTN NumberOfPartition;
200- EFI_GPT_DATA *GptData;
201- EFI_TCG2_EVENT *Tcg2Event;
202-
203- Tcg2Event = NULL;
204- GptData = NULL;
205
206 // Test that a normal PrimaryHeader passes validation
207 PrimaryHeader.NumberOfPartitionEntries = 5;
208@@ -225,6 +220,52 @@ TestSanitizePrimaryHeaderGptEventSize (
209 return UNIT_TEST_PASSED;
210 }
211
212+/**
213+ This function tests the SanitizePeImageEventSize function.
214+ It's intent is to test that the untrusted input from a file path when generating a
215+ EFI_IMAGE_LOAD_EVENT structure will not cause an overflow when calculating
216+ the event size when allocating space
217+
218+ @param[in] Context The unit test context.
219+
220+ @retval UNIT_TEST_PASSED The test passed.
221+ @retval UNIT_TEST_ERROR_TEST_FAILED The test failed.
222+**/
223+UNIT_TEST_STATUS
224+EFIAPI
225+TestSanitizePeImageEventSize (
226+ IN UNIT_TEST_CONTEXT Context
227+ )
228+{
229+ UINT32 EventSize;
230+ UINTN ExistingLogicEventSize;
231+ UINT32 FilePathSize;
232+ EFI_STATUS Status;
233+
234+ FilePathSize = 255;
235+
236+ // Test that a normal PE image passes validation
237+ Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
238+ UT_ASSERT_EQUAL (Status, EFI_SUCCESS);
239+
240+ // Test that the event size is correct compared to the existing logic
241+ ExistingLogicEventSize = OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath) + FilePathSize;
242+ ExistingLogicEventSize += OFFSET_OF (EFI_TCG2_EVENT, Event);
243+
244+ if (EventSize != ExistingLogicEventSize) {
245+ UT_LOG_ERROR ("SanitizePeImageEventSize returned an incorrect event size. Expected %u, got %u\n", ExistingLogicEventSize, EventSize);
246+ return UNIT_TEST_ERROR_TEST_FAILED;
247+ }
248+
249+ // Test that the event size may not overflow
250+ Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
251+ UT_ASSERT_EQUAL (Status, EFI_BAD_BUFFER_SIZE);
252+
253+ DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
254+
255+ return UNIT_TEST_PASSED;
256+}
257+
258 // *--------------------------------------------------------------------*
259 // * Unit Test Code Main Function
260 // *--------------------------------------------------------------------*
261@@ -267,6 +308,7 @@ UefiTestMain (
262 AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.Tcg2MeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
263 AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
264 AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
265+ AddTestCase (Tcg2MeasureBootLibValidationTestSuite, "Tests PE Image and FileSize checks for overflow", "Common.Tcg2MeasureBootLibValidation", TestSanitizePeImageEventSize, NULL, NULL, NULL);
266
267 Status = RunAllTestSuites (Framework);
268
269--
2702.40.0
271
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0002.patch b/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0002.patch
new file mode 100644
index 0000000000..22a7713f52
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0002.patch
@@ -0,0 +1,281 @@
1From 0d341c01eeabe0ab5e76693b36e728b8f538a40e Mon Sep 17 00:00:00 2001
2From: "Douglas Flick [MSFT]" <doug.edk2@gmail.com>
3Date: Fri, 12 Jan 2024 02:16:05 +0800
4Subject: [PATCH] SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE
5 2022-36764
6
7This commit contains the patch files and tests for DxeTpmMeasureBootLib
8CVE 2022-36764.
9
10Cc: Jiewen Yao <jiewen.yao@intel.com>
11
12Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
13Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
14
15CVE: CVE-2022-36764
16
17Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/0d341c01eeabe0ab5e76693b36e728b8f538a40e]
18
19Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
20---
21 .../DxeTpmMeasureBootLib.c | 13 ++-
22 .../DxeTpmMeasureBootLibSanitization.c | 44 +++++++++
23 .../DxeTpmMeasureBootLibSanitization.h | 23 +++++
24 .../DxeTpmMeasureBootLibSanitizationTest.c | 98 +++++++++++++++++--
25 4 files changed, 168 insertions(+), 10 deletions(-)
26
27diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
28index 669ab19134..a9fc440a09 100644
29--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
30+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLib.c
31@@ -17,6 +17,7 @@
32
33 Copyright (c) 2009 - 2018, Intel Corporation. All rights reserved.<BR>
34 SPDX-License-Identifier: BSD-2-Clause-Patent
35+Copyright (c) Microsoft Corporation.<BR>
36
37 Copyright (c) Microsoft Corporation.<BR>
38 SPDX-License-Identifier: BSD-2-Clause-Patent
39@@ -345,18 +346,22 @@ TcgMeasurePeImage (
40 ImageLoad = NULL;
41 SectionHeader = NULL;
42 Sha1Ctx = NULL;
43+ TcgEvent = NULL;
44 FilePathSize = (UINT32)GetDevicePathSize (FilePath);
45
46- //
47 // Determine destination PCR by BootPolicy
48 //
49- EventSize = sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
50- TcgEvent = AllocateZeroPool (EventSize + sizeof (TCG_PCR_EVENT));
51+ Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
52+ if (EFI_ERROR (Status)) {
53+ return EFI_UNSUPPORTED;
54+ }
55+
56+ TcgEvent = AllocateZeroPool (EventSize);
57 if (TcgEvent == NULL) {
58 return EFI_OUT_OF_RESOURCES;
59 }
60
61- TcgEvent->EventSize = EventSize;
62+ TcgEvent->EventSize = EventSize - sizeof (TCG_PCR_EVENT_HDR);
63 ImageLoad = (EFI_IMAGE_LOAD_EVENT *)TcgEvent->Event;
64
65 switch (ImageType) {
66diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
67index a3fa46f5e6..c989851cec 100644
68--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
69+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.c
70@@ -239,3 +239,47 @@ SanitizePrimaryHeaderGptEventSize (
71
72 return EFI_SUCCESS;
73 }
74+
75+/**
76+ This function will validate that the PeImage Event Size from the loaded image is sane
77+ It will check the following:
78+ - EventSize does not overflow
79+
80+ @param[in] FilePathSize - Size of the file path.
81+ @param[out] EventSize - Pointer to the event size.
82+
83+ @retval EFI_SUCCESS
84+ The event size is valid.
85+
86+ @retval EFI_OUT_OF_RESOURCES
87+ Overflow would have occurred.
88+
89+ @retval EFI_INVALID_PARAMETER
90+ One of the passed parameters was invalid.
91+**/
92+EFI_STATUS
93+SanitizePeImageEventSize (
94+ IN UINT32 FilePathSize,
95+ OUT UINT32 *EventSize
96+ )
97+{
98+ EFI_STATUS Status;
99+
100+ // Replacing logic:
101+ // sizeof (*ImageLoad) - sizeof (ImageLoad->DevicePath) + FilePathSize;
102+ Status = SafeUint32Add (OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath), FilePathSize, EventSize);
103+ if (EFI_ERROR (Status)) {
104+ DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
105+ return EFI_BAD_BUFFER_SIZE;
106+ }
107+
108+ // Replacing logic:
109+ // EventSize + sizeof (TCG_PCR_EVENT_HDR)
110+ Status = SafeUint32Add (*EventSize, sizeof (TCG_PCR_EVENT_HDR), EventSize);
111+ if (EFI_ERROR (Status)) {
112+ DEBUG ((DEBUG_ERROR, "EventSize would overflow!\n"));
113+ return EFI_BAD_BUFFER_SIZE;
114+ }
115+
116+ return EFI_SUCCESS;
117+}
118diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
119index 0d9d00c281..2248495813 100644
120--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
121+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/DxeTpmMeasureBootLibSanitization.h
122@@ -111,4 +111,27 @@ SanitizePrimaryHeaderGptEventSize (
123 OUT UINT32 *EventSize
124 );
125
126+/**
127+ This function will validate that the PeImage Event Size from the loaded image is sane
128+ It will check the following:
129+ - EventSize does not overflow
130+
131+ @param[in] FilePathSize - Size of the file path.
132+ @param[out] EventSize - Pointer to the event size.
133+
134+ @retval EFI_SUCCESS
135+ The event size is valid.
136+
137+ @retval EFI_OUT_OF_RESOURCES
138+ Overflow would have occurred.
139+
140+ @retval EFI_INVALID_PARAMETER
141+ One of the passed parameters was invalid.
142+**/
143+EFI_STATUS
144+SanitizePeImageEventSize (
145+ IN UINT32 FilePathSize,
146+ OUT UINT32 *EventSize
147+ );
148+
149 #endif // DXE_TPM_MEASURE_BOOT_LIB_VALIDATION_
150diff --git a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
151index eeb928cdb0..c41498be45 100644
152--- a/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
153+++ b/SecurityPkg/Library/DxeTpmMeasureBootLib/InternalUnitTest/DxeTpmMeasureBootLibSanitizationTest.c
154@@ -1,8 +1,8 @@
155 /** @file
156-This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
157+ This file includes the unit test cases for the DxeTpmMeasureBootLibSanitizationTest.c.
158
159-Copyright (c) Microsoft Corporation.<BR>
160-SPDX-License-Identifier: BSD-2-Clause-Patent
161+ Copyright (c) Microsoft Corporation.<BR>
162+ SPDX-License-Identifier: BSD-2-Clause-Patent
163 **/
164
165 #include <Uefi.h>
166@@ -186,9 +186,6 @@ TestSanitizePrimaryHeaderGptEventSize (
167 EFI_STATUS Status;
168 EFI_PARTITION_TABLE_HEADER PrimaryHeader;
169 UINTN NumberOfPartition;
170- EFI_GPT_DATA *GptData;
171-
172- GptData = NULL;
173
174 // Test that a normal PrimaryHeader passes validation
175 PrimaryHeader.NumberOfPartitionEntries = 5;
176@@ -222,6 +219,94 @@ TestSanitizePrimaryHeaderGptEventSize (
177 return UNIT_TEST_PASSED;
178 }
179
180+/**
181+ This function tests the SanitizePeImageEventSize function.
182+ It's intent is to test that the untrusted input from a file path for an
183+ EFI_IMAGE_LOAD_EVENT structure will not cause an overflow when calculating
184+ the event size when allocating space.
185+
186+ @param[in] Context The unit test context.
187+
188+ @retval UNIT_TEST_PASSED The test passed.
189+ @retval UNIT_TEST_ERROR_TEST_FAILED The test failed.
190+**/
191+UNIT_TEST_STATUS
192+EFIAPI
193+TestSanitizePeImageEventSize (
194+ IN UNIT_TEST_CONTEXT Context
195+ )
196+{
197+ UINT32 EventSize;
198+ UINTN ExistingLogicEventSize;
199+ UINT32 FilePathSize;
200+ EFI_STATUS Status;
201+ EFI_DEVICE_PATH_PROTOCOL DevicePath;
202+ EFI_IMAGE_LOAD_EVENT *ImageLoadEvent;
203+ UNIT_TEST_STATUS TestStatus;
204+
205+ TestStatus = UNIT_TEST_ERROR_TEST_FAILED;
206+
207+ // Generate EFI_DEVICE_PATH_PROTOCOL test data
208+ DevicePath.Type = 0;
209+ DevicePath.SubType = 0;
210+ DevicePath.Length[0] = 0;
211+ DevicePath.Length[1] = 0;
212+
213+ // Generate EFI_IMAGE_LOAD_EVENT test data
214+ ImageLoadEvent = AllocateZeroPool (sizeof (EFI_IMAGE_LOAD_EVENT) + sizeof (EFI_DEVICE_PATH_PROTOCOL));
215+ if (ImageLoadEvent == NULL) {
216+ DEBUG ((DEBUG_ERROR, "%a: AllocateZeroPool failed\n", __func__));
217+ goto Exit;
218+ }
219+
220+ // Populate EFI_IMAGE_LOAD_EVENT54 test data
221+ ImageLoadEvent->ImageLocationInMemory = (EFI_PHYSICAL_ADDRESS)0x12345678;
222+ ImageLoadEvent->ImageLengthInMemory = 0x1000;
223+ ImageLoadEvent->ImageLinkTimeAddress = (UINTN)ImageLoadEvent;
224+ ImageLoadEvent->LengthOfDevicePath = sizeof (EFI_DEVICE_PATH_PROTOCOL);
225+ CopyMem (ImageLoadEvent->DevicePath, &DevicePath, sizeof (EFI_DEVICE_PATH_PROTOCOL));
226+
227+ FilePathSize = 255;
228+
229+ // Test that a normal PE image passes validation
230+ Status = SanitizePeImageEventSize (FilePathSize, &EventSize);
231+ if (EFI_ERROR (Status)) {
232+ UT_LOG_ERROR ("SanitizePeImageEventSize failed with %r\n", Status);
233+ goto Exit;
234+ }
235+
236+ // Test that the event size is correct compared to the existing logic
237+ ExistingLogicEventSize = OFFSET_OF (EFI_IMAGE_LOAD_EVENT, DevicePath) + FilePathSize;
238+ ExistingLogicEventSize += sizeof (TCG_PCR_EVENT_HDR);
239+
240+ if (EventSize != ExistingLogicEventSize) {
241+ UT_LOG_ERROR ("SanitizePeImageEventSize returned an incorrect event size. Expected %u, got %u\n", ExistingLogicEventSize, EventSize);
242+ goto Exit;
243+ }
244+
245+ // Test that the event size may not overflow
246+ Status = SanitizePeImageEventSize (MAX_UINT32, &EventSize);
247+ if (Status != EFI_BAD_BUFFER_SIZE) {
248+ UT_LOG_ERROR ("SanitizePeImageEventSize succeded when it was supposed to fail with %r\n", Status);
249+ goto Exit;
250+ }
251+
252+ TestStatus = UNIT_TEST_PASSED;
253+Exit:
254+
255+ if (ImageLoadEvent != NULL) {
256+ FreePool (ImageLoadEvent);
257+ }
258+
259+ if (TestStatus == UNIT_TEST_ERROR_TEST_FAILED) {
260+ DEBUG ((DEBUG_ERROR, "%a: Test failed\n", __func__));
261+ } else {
262+ DEBUG ((DEBUG_INFO, "%a: Test passed\n", __func__));
263+ }
264+
265+ return TestStatus;
266+}
267+
268 // *--------------------------------------------------------------------*
269 // * Unit Test Code Main Function
270 // *--------------------------------------------------------------------*
271@@ -265,6 +350,7 @@ UefiTestMain (
272 AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Validating EFI Partition Table", "Common.TcgMeasureBootLibValidation", TestSanitizeEfiPartitionTableHeader, NULL, NULL, NULL);
273 AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header gpt event checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderAllocationSize, NULL, NULL, NULL);
274 AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests Primary header allocation size checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePrimaryHeaderGptEventSize, NULL, NULL, NULL);
275+ AddTestCase (TcgMeasureBootLibValidationTestSuite, "Tests PE Image and FileSize checks for overflow", "Common.TcgMeasureBootLibValidation", TestSanitizePeImageEventSize, NULL, NULL, NULL);
276
277 Status = RunAllTestSuites (Framework);
278
279--
2802.40.0
281
diff --git a/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0003.patch b/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0003.patch
new file mode 100644
index 0000000000..89386c0c29
--- /dev/null
+++ b/meta/recipes-core/ovmf/ovmf/CVE-2022-36764-0003.patch
@@ -0,0 +1,48 @@
1From 8f6d343ae639fba8e4b80e45257275e23083431f Mon Sep 17 00:00:00 2001
2From: "Douglas Flick [MSFT]" <doug.edk2@gmail.com>
3Date: Fri, 12 Jan 2024 02:16:06 +0800
4Subject: [PATCH] SecurityPkg: : Adding CVE 2022-36764 to SecurityFixes.yaml
5
6This creates / adds a security file that tracks the security fixes
7found in this package and can be used to find the fixes that were
8applied.
9
10Cc: Jiewen Yao <jiewen.yao@intel.com>
11
12Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
13Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
14
15CVE: CVE-2022-36764
16
17Upstream-Status: Backport [https://github.com/tianocore/edk2/commit/8f6d343ae639fba8e4b80e45257275e23083431f]
18
19Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
20---
21 SecurityPkg/SecurityFixes.yaml | 14 ++++++++++++++
22 1 file changed, 14 insertions(+)
23
24diff --git a/SecurityPkg/SecurityFixes.yaml b/SecurityPkg/SecurityFixes.yaml
25index f9e3e7be74..833fb827a9 100644
26--- a/SecurityPkg/SecurityFixes.yaml
27+++ b/SecurityPkg/SecurityFixes.yaml
28@@ -20,3 +20,17 @@ CVE_2022_36763:
29 - https://bugzilla.tianocore.org/show_bug.cgi?id=4117
30 - https://bugzilla.tianocore.org/show_bug.cgi?id=2168
31 - https://bugzilla.tianocore.org/show_bug.cgi?id=1990
32+CVE_2022_36764:
33+ commit_titles:
34+ - "SecurityPkg: DxeTpm2MeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
35+ - "SecurityPkg: DxeTpmMeasureBootLib: SECURITY PATCH 4118 - CVE 2022-36764"
36+ - "SecurityPkg: : Adding CVE 2022-36764 to SecurityFixes.yaml"
37+ cve: CVE-2022-36764
38+ date_reported: 2022-10-25 12:23 UTC
39+ description: Heap Buffer Overflow in Tcg2MeasurePeImage()
40+ note:
41+ files_impacted:
42+ - Library\DxeTpm2MeasureBootLib\DxeTpm2MeasureBootLib.c
43+ - Library\DxeTpmMeasureBootLib\DxeTpmMeasureBootLib.c
44+ links:
45+ - https://bugzilla.tianocore.org/show_bug.cgi?id=4118
46--
472.40.0
48
diff --git a/meta/recipes-core/ovmf/ovmf_git.bb b/meta/recipes-core/ovmf/ovmf_git.bb
index 78d86ad879..59e5598a1b 100644
--- a/meta/recipes-core/ovmf/ovmf_git.bb
+++ b/meta/recipes-core/ovmf/ovmf_git.bb
@@ -30,6 +30,9 @@ SRC_URI = "gitsm://github.com/tianocore/edk2.git;branch=master;protocol=https \
30 file://CVE-2022-36763-0001.patch \ 30 file://CVE-2022-36763-0001.patch \
31 file://CVE-2022-36763-0002.patch \ 31 file://CVE-2022-36763-0002.patch \
32 file://CVE-2022-36763-0003.patch \ 32 file://CVE-2022-36763-0003.patch \
33 file://CVE-2022-36764-0001.patch \
34 file://CVE-2022-36764-0002.patch \
35 file://CVE-2022-36764-0003.patch \
33 " 36 "
34 37
35PV = "edk2-stable202202" 38PV = "edk2-stable202202"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-09 21:53:59 +0000