tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SecuritPkg: DxeImageVerificationLib: Fix wrong verification logic in DBX & DBT 

In image verification, if image verified pass in DBT, still need to verify if it is blocked by any other cert/cert hash from DBX.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>
Reviewed-by: Dick Wilkins <dick_wilkins@phoenix.com>
This commit is contained in:
Zhang, Chao B 2016-04-13 16:25:50 +08:00
parent 07e8892090
commit 91422384d5
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
View File

@ -12,7 +12,7 @@
DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept DxeImageVerificationHandler(), HashPeImageByType(), HashPeImage() function will accept
untrusted PE/COFF image and validate its data structure within this image buffer before use. untrusted PE/COFF image and validate its data structure within this image buffer before use.
Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR> Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -1457,6 +1457,10 @@ IsForbiddenByDbx (
for (Index = 0; Index < CertNumber; Index++) { for (Index = 0; Index < CertNumber; Index++) {
CertSize = (UINTN) ReadUnaligned32 ((UINT32 *)CertPtr); CertSize = (UINTN) ReadUnaligned32 ((UINT32 *)CertPtr);
Cert = (UINT8 *)CertPtr + sizeof (UINT32); Cert = (UINT8 *)CertPtr + sizeof (UINT32);
//
// Advance CertPtr to the next cert in image signer's cert list
//
CertPtr = CertPtr + sizeof (UINT32) + CertSize;
if (IsCertHashFoundInDatabase (Cert, CertSize, (EFI_SIGNATURE_LIST *)Data, DataSize, &RevocationTime)) { if (IsCertHashFoundInDatabase (Cert, CertSize, (EFI_SIGNATURE_LIST *)Data, DataSize, &RevocationTime)) {
// //
@ -1465,11 +1469,14 @@ IsForbiddenByDbx (
IsForbidden = TRUE; IsForbidden = TRUE;
if (PassTimestampCheck (AuthData, AuthDataSize, &RevocationTime)) { if (PassTimestampCheck (AuthData, AuthDataSize, &RevocationTime)) {
IsForbidden = FALSE; IsForbidden = FALSE;
//
// Pass DBT check. Continue to check other certs in image signer's cert list against DBX, DBT
//
continue;
} }
goto Done; goto Done;
} }
CertPtr = CertPtr + sizeof (UINT32) + CertSize;
} }
Done: Done: