From d17c4eac5625e40fa3715aee14286f45797b3999 Mon Sep 17 00:00:00 2001 From: czhang46 Date: Fri, 19 Apr 2013 01:35:02 +0000 Subject: Fix a potential SMM memory dump issue. If pass communication buffer with DataBuffer to SMM SetVariable which is big enough to cover SMM range. Then GetVariable can dump SMM memory contents. Add more range check for SetVariable Signed-off-by: Chao Zhang Reviewed-by : Dong Guo Reviewed-by : Jiewen Yao git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14292 6f19259b-4bc3-4df7-8a09-765794883524 --- MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c | 13 +++++++++++++ SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c | 13 +++++++++++++ 2 files changed, 26 insertions(+) diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c index 550f01a525..7541f6ae1d 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c @@ -482,6 +482,19 @@ SmmVariableHandler ( case SMM_VARIABLE_FUNCTION_SET_VARIABLE: SmmVariableHeader = (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE *) SmmVariableFunctionHeader->Data; + InfoSize = OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + + SmmVariableHeader->DataSize + SmmVariableHeader->NameSize; + + // + // SMRAM range check already covered before + // Data buffer should not contain SMM range + // + if (InfoSize > *CommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE) { + DEBUG ((EFI_D_ERROR, "Data size exceed communication buffer size limit!\n")); + Status = EFI_ACCESS_DENIED; + goto EXIT; + } + Status = VariableServiceSetVariable ( SmmVariableHeader->Name, &SmmVariableHeader->Guid, diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c index 316845f045..678cff3c7d 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.c @@ -488,6 +488,19 @@ SmmVariableHandler ( case SMM_VARIABLE_FUNCTION_SET_VARIABLE: SmmVariableHeader = (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE *) SmmVariableFunctionHeader->Data; + InfoSize = OFFSET_OF(SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + + SmmVariableHeader->DataSize + SmmVariableHeader->NameSize; + + // + // SMRAM range check already covered before + // Data buffer should not contain SMM range + // + if (InfoSize > *CommBufferSize - SMM_VARIABLE_COMMUNICATE_HEADER_SIZE) { + DEBUG ((EFI_D_ERROR, "Data size exceed communication buffer size limit!\n")); + Status = EFI_ACCESS_DENIED; + goto EXIT; + } + Status = VariableServiceSetVariable ( SmmVariableHeader->Name, &SmmVariableHeader->Guid, -- cgit v1.2.3