mirror of https://github.com/acidanthera/audk.git
f31453e8d6
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4535 Bug Details: PixieFail Bug #2 CVE-2023-45230 CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Changes Overview: > -UINT8 * > +EFI_STATUS > Dhcp6AppendOption ( > - IN OUT UINT8 *Buf, > - IN UINT16 OptType, > - IN UINT16 OptLen, > - IN UINT8 *Data > + IN OUT EFI_DHCP6_PACKET *Packet, > + IN OUT UINT8 **PacketCursor, > + IN UINT16 OptType, > + IN UINT16 OptLen, > + IN UINT8 *Data > ); Dhcp6AppendOption() and variants can return errors now. All callsites are adapted accordingly. It gets passed in EFI_DHCP6_PACKET as additional parameter ... > + // > + // Verify the PacketCursor is within the packet > + // > + if ( (*PacketCursor < Packet->Dhcp6.Option) > + || (*PacketCursor >= Packet->Dhcp6.Option + (Packet->Size - sizeof (EFI_DHCP6_HEADER)))) > + { > + return EFI_INVALID_PARAMETER; > + } ... so it can look at Packet->Size when checking buffer space. Also to allow Packet->Length updates. Lots of checks added. Cc: Saloni Kasbekar <saloni.kasbekar@intel.com> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com> Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com> |
||
|---|---|---|
| .. | ||
| Application/VConfig | ||
| ArpDxe | ||
| Dhcp4Dxe | ||
| Dhcp6Dxe | ||
| DnsDxe | ||
| DpcDxe | ||
| HttpBootDxe | ||
| HttpDxe | ||
| HttpUtilitiesDxe | ||
| IScsiDxe | ||
| Include | ||
| Ip4Dxe | ||
| Ip6Dxe | ||
| Library | ||
| MnpDxe | ||
| Mtftp4Dxe | ||
| Mtftp6Dxe | ||
| SnpDxe | ||
| TcpDxe | ||
| TlsAuthConfigDxe | ||
| TlsDxe | ||
| Udp4Dxe | ||
| Udp6Dxe | ||
| UefiPxeBcDxe | ||
| VlanConfigDxe | ||
| WifiConnectionManagerDxe | ||
| Network.dsc.inc | ||
| Network.fdf.inc | ||
| NetworkBuildOptions.dsc.inc | ||
| NetworkComponents.dsc.inc | ||
| NetworkDefines.dsc.inc | ||
| NetworkLibs.dsc.inc | ||
| NetworkPcds.dsc.inc | ||
| NetworkPkg.ci.yaml | ||
| NetworkPkg.dec | ||
| NetworkPkg.dsc | ||
| NetworkPkg.uni | ||
| NetworkPkgExtra.uni | ||