mirror of https://github.com/acidanthera/audk.git
47b76780b4
The IScsiHexToBin() function has the following parser issues:
(1) If the *subject sequence* in "HexStr" is empty, the function returns
EFI_SUCCESS (with "BinLength" set to 0 on output). Such inputs should
be rejected.
(2) The function mis-handles a "HexStr" that ends with a stray nibble. For
example, if "HexStr" is "0xABC", the function decodes it to the bytes
{0xAB, 0x0C}, sets "BinLength" to 2 on output, and returns
EFI_SUCCESS. Such inputs should be rejected.
(3) If an invalid hex char is found in "HexStr", the function treats it as
end-of-hex-string, and returns EFI_SUCCESS. Such inputs should be
rejected.
All of the above cases are remotely triggerable, as shown in a subsequent
patch, which adds error checking to the IScsiHexToBin() call sites. While
the initiator is not immediately compromised, incorrectly parsing CHAP_R
from the target, in case of mutual authentication, is not great.
Extend the interface contract of IScsiHexToBin() with
EFI_INVALID_PARAMETER, for reporting issues (1) through (3), and implement
the new checks.
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3356
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Maciej Rabeda <maciej.rabeda@linux.intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210608121259.32451-9-lersek@redhat.com>
|
||
|---|---|---|
| .. | ||
| Application/VConfig | ||
| ArpDxe | ||
| Dhcp4Dxe | ||
| Dhcp6Dxe | ||
| DnsDxe | ||
| DpcDxe | ||
| HttpBootDxe | ||
| HttpDxe | ||
| HttpUtilitiesDxe | ||
| IScsiDxe | ||
| Include | ||
| Ip4Dxe | ||
| Ip6Dxe | ||
| Library | ||
| MnpDxe | ||
| Mtftp4Dxe | ||
| Mtftp6Dxe | ||
| SnpDxe | ||
| TcpDxe | ||
| TlsAuthConfigDxe | ||
| TlsDxe | ||
| Udp4Dxe | ||
| Udp6Dxe | ||
| UefiPxeBcDxe | ||
| VlanConfigDxe | ||
| WifiConnectionManagerDxe | ||
| Network.dsc.inc | ||
| Network.fdf.inc | ||
| NetworkBuildOptions.dsc.inc | ||
| NetworkComponents.dsc.inc | ||
| NetworkDefines.dsc.inc | ||
| NetworkLibs.dsc.inc | ||
| NetworkPcds.dsc.inc | ||
| NetworkPkg.ci.yaml | ||
| NetworkPkg.dec | ||
| NetworkPkg.dsc | ||
| NetworkPkg.uni | ||
| NetworkPkgExtra.uni | ||