mirror of
https://git.yoctoproject.org/meta-arm
synced 2026-11-14 02:47:07 +00:00
arm/edk2-firmware: fix ICMP error handling vulnerabilities
Backport two upstream EDK2 fixes to address security issues in the IPv4 and IPv6 ICMP error handlers. CVE-2026-97631 fixes incorrect buffer copy logic that could allow oversized ICMP error packets to write beyond the allocated buffer, potentially causing memory corruption. Add proper boundary checks and correct buffer offset calculations to safely truncate packets that exceed the available buffer space. The second fix initializes the ICMP error buffer before copying received fragments, preventing short packets from leaving stale data from previous errors in the buffer. These fixes have been merged upstream as commits 560ed9b5b146ed622d7eb7c40254a9099bd65b84 and fa789071ff0b29f1e568bfe153ef7f3d76bd60e4. Signed-off-by: Jon Mason <jon.mason@arm.com>
This commit is contained in:
Jon Mason committed
1 parent
4775233f85
commit
0fb130619a
4 files changed
+171
-5
No files matched your search
+1
-4
@@ -1,4 +1,4 @@
|
||||
From 7d2f6b6e31fad2c96c6fc55c17e79f8c96b4bfcf Mon Sep 17 00:00:00 2001
|
||||
From 0debd3a1f4b5abf0c75c26ec1e85d9fa33510c89 Mon Sep 17 00:00:00 2001
|
||||
From: Yeoreum Yun <yeoreum.yun@arm.com>
|
||||
Date: Mon, 10 Aug 2026 15:40:06 +0100
|
||||
Subject: [PATCH] DynamicTablesPkg: fix SmbiosType2Genertor build failure with
|
||||
@@ -36,6 +36,3 @@ index 1250ef8059e9..5345d2b6d233 100644
|
||||
{
|
||||
DEBUG ((DEBUG_ERROR, "%a: Invalid Baseboard object list\n", __func__));
|
||||
return EFI_INVALID_PARAMETER;
|
||||
--
|
||||
2.39.5
|
||||
|
||||
+127
@@ -0,0 +1,127 @@
|
||||
From 1c89a7982247eb994956140caf794f4f40e85de9 Mon Sep 17 00:00:00 2001
|
||||
From: santhoshkumarv <santhoshkumarv@ami.com>
|
||||
Date: Mon, 28 Sep 2026 06:06:24 -0700
|
||||
Subject: [PATCH] NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in
|
||||
IPv4/IPv6 handlers (CVE-2026-97631)
|
||||
|
||||
Root Cause:
|
||||
Incorrect buffer copy logic in ICMP error handling allowed large packets
|
||||
to write beyond the allocated buffer. This could overwrite adjacent memory
|
||||
with attacker-controlled data, causing memory corruption.
|
||||
|
||||
Resolution:
|
||||
Added proper boundary checks and corrected buffer offset calculations
|
||||
in IPv4 and IPv6 ICMP error handlers. Over sized ICMP error packets are now
|
||||
safely truncated when the buffer is full, preventing memory corruption.
|
||||
|
||||
Signed-off-by: santhoshkumarV <santhoshkumarv@ami.com>
|
||||
|
||||
Upstream-Status: Backport [560ed9b5b146ed622d7eb7c40254a9099bd65b84]
|
||||
CVE: CVE-2026-97631
|
||||
Signed-off-by: Jon Mason <jon.mason@arm.com>
|
||||
---
|
||||
NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c | 68 ++++++++++----------------
|
||||
1 file changed, 26 insertions(+), 42 deletions(-)
|
||||
|
||||
diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
|
||||
index 887ea3e7d7d8..9e97ba4904c7 100644
|
||||
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
|
||||
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
|
||||
@@ -252,6 +252,7 @@ PxeBcIcmpErrorDpcHandle (
|
||||
UINTN Index;
|
||||
UINT32 CopiedLen;
|
||||
UINT8 *IcmpError;
|
||||
+ UINT32 FragmentLen;
|
||||
|
||||
Private = (PXEBC_PRIVATE_DATA *)Context;
|
||||
Mode = &Private->Mode;
|
||||
@@ -317,28 +318,19 @@ PxeBcIcmpErrorDpcHandle (
|
||||
}
|
||||
|
||||
//
|
||||
- // Copy the right ICMP error message into mode data.
|
||||
+ // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
|
||||
+ // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
|
||||
//
|
||||
- CopiedLen = 0;
|
||||
- IcmpError = (UINT8 *)&Mode->IcmpError;
|
||||
-
|
||||
- for (Index = 0; Index < RxData->FragmentCount; Index++) {
|
||||
- CopiedLen += RxData->FragmentTable[Index].FragmentLength;
|
||||
- if (CopiedLen <= sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)) {
|
||||
- CopyMem (
|
||||
- IcmpError,
|
||||
- RxData->FragmentTable[Index].FragmentBuffer,
|
||||
- RxData->FragmentTable[Index].FragmentLength
|
||||
- );
|
||||
- } else {
|
||||
- CopyMem (
|
||||
- IcmpError,
|
||||
- RxData->FragmentTable[Index].FragmentBuffer,
|
||||
- CopiedLen - sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)
|
||||
- );
|
||||
- }
|
||||
-
|
||||
- IcmpError += CopiedLen;
|
||||
+ for (Index = 0, IcmpError = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
|
||||
+ (Index < RxData->FragmentCount) &&
|
||||
+ (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
|
||||
+ Index++, IcmpError += FragmentLen, CopiedLen += FragmentLen)
|
||||
+ {
|
||||
+ FragmentLen = MIN (
|
||||
+ RxData->FragmentTable[Index].FragmentLength,
|
||||
+ (UINT32)(sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR) - CopiedLen)
|
||||
+ );
|
||||
+ CopyMem (IcmpError, RxData->FragmentTable[Index].FragmentBuffer, FragmentLen);
|
||||
}
|
||||
|
||||
ON_RECYCLE:
|
||||
@@ -387,6 +379,7 @@ PxeBcIcmp6ErrorDpcHandle (
|
||||
UINT8 Type;
|
||||
UINT32 CopiedLen;
|
||||
UINT8 *Icmp6Error;
|
||||
+ UINT32 FragmentLen;
|
||||
|
||||
Private = (PXEBC_PRIVATE_DATA *)Context;
|
||||
Mode = &Private->Mode;
|
||||
@@ -449,28 +442,19 @@ PxeBcIcmp6ErrorDpcHandle (
|
||||
}
|
||||
|
||||
//
|
||||
- // Copy the right ICMP6 error message into mode data.
|
||||
+ // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
|
||||
+ // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
|
||||
//
|
||||
- CopiedLen = 0;
|
||||
- Icmp6Error = (UINT8 *)&Mode->IcmpError;
|
||||
-
|
||||
- for (Index = 0; Index < RxData->FragmentCount; Index++) {
|
||||
- CopiedLen += RxData->FragmentTable[Index].FragmentLength;
|
||||
- if (CopiedLen <= sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)) {
|
||||
- CopyMem (
|
||||
- Icmp6Error,
|
||||
- RxData->FragmentTable[Index].FragmentBuffer,
|
||||
- RxData->FragmentTable[Index].FragmentLength
|
||||
- );
|
||||
- } else {
|
||||
- CopyMem (
|
||||
- Icmp6Error,
|
||||
- RxData->FragmentTable[Index].FragmentBuffer,
|
||||
- CopiedLen - sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)
|
||||
- );
|
||||
- }
|
||||
-
|
||||
- Icmp6Error += CopiedLen;
|
||||
+ for (Index = 0, Icmp6Error = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
|
||||
+ (Index < RxData->FragmentCount) &&
|
||||
+ (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
|
||||
+ Index++, Icmp6Error += FragmentLen, CopiedLen += FragmentLen)
|
||||
+ {
|
||||
+ FragmentLen = MIN (
|
||||
+ RxData->FragmentTable[Index].FragmentLength,
|
||||
+ (UINT32)(sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR) - CopiedLen)
|
||||
+ );
|
||||
+ CopyMem (Icmp6Error, RxData->FragmentTable[Index].FragmentBuffer, FragmentLen);
|
||||
}
|
||||
|
||||
ON_RECYCLE:
|
||||
+38
@@ -0,0 +1,38 @@
|
||||
From bff45da697fecf64927fbc38eacfcf41f20b763b Mon Sep 17 00:00:00 2001
|
||||
From: Michael D Kinney <michael.d.kinney@intel.com>
|
||||
Date: Wed, 14 Oct 2026 12:34:35 -0700
|
||||
Subject: [PATCH] NetworkPkg/UefiPxeBcDxe: Clear ICMP error buffer before
|
||||
copying
|
||||
|
||||
Zero the ICMP error buffer before copying fragments so short packets do not
|
||||
leave stale bytes from a previous error.
|
||||
|
||||
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
|
||||
|
||||
Upstream-Status: Backport [fa789071ff0b29f1e568bfe153ef7f3d76bd60e4]
|
||||
CVE: CVE-2026-97631
|
||||
Signed-off-by: Jon Mason <jon.mason@arm.com>
|
||||
---
|
||||
NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
|
||||
index 9e97ba4904c7..7795e4f187d2 100644
|
||||
--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
|
||||
+++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
|
||||
@@ -321,6 +321,7 @@ PxeBcIcmpErrorDpcHandle (
|
||||
// Copy ICMP error fragments into Mode->IcmpError in order. The maximum
|
||||
// buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
|
||||
//
|
||||
+ ZeroMem (&Mode->IcmpError, sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
|
||||
for (Index = 0, IcmpError = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
|
||||
(Index < RxData->FragmentCount) &&
|
||||
(CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
|
||||
@@ -445,6 +446,7 @@ PxeBcIcmp6ErrorDpcHandle (
|
||||
// Copy ICMP error fragments into Mode->IcmpError in order. The maximum
|
||||
// buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
|
||||
//
|
||||
+ ZeroMem (&Mode->IcmpError, sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
|
||||
for (Index = 0, Icmp6Error = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
|
||||
(Index < RxData->FragmentCount) &&
|
||||
(CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
|
||||
@@ -4,4 +4,8 @@ SRCREV_edk2 ?= "2970e5699ba6267f3384ffab20f96647578aebc8"
|
||||
SRCREV_edk2-platforms ?= "c98cdf8de9bd84a3267623e64f4388e21de69512"
|
||||
|
||||
FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
|
||||
SRC_URI += "file://0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch"
|
||||
SRC_URI += " \
|
||||
file://0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch \
|
||||
file://0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch \
|
||||
file://0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch \
|
||||
"
|
||||
Reference in new issue
Block a user