diff options
| author | Gua Guo <gua.guo@intel.com> | 2024-01-11 13:07:50 +0800 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2024-01-26 03:40:09 +0000 |
| commit | aeaee8944f0eaacbf4cdf39279785b9ba4836bb6 (patch) | |
| tree | c4121c75a5e6d9273ebc1a53b7e5153b6cda31c4 /UnitTestFrameworkPkg | |
| parent | 049695a0b1e2a9cbb7c2088a918f285bbb950999 (diff) | |
| download | edk2-aeaee8944f0eaacbf4cdf39279785b9ba4836bb6.zip edk2-aeaee8944f0eaacbf4cdf39279785b9ba4836bb6.tar.gz edk2-aeaee8944f0eaacbf4cdf39279785b9ba4836bb6.tar.bz2 | |
EmbeddedPkg/Hob: Integer Overflow in CreateHob()
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4166
Fix integer overflow in various CreateHob instances.
Fixes: CVE-2022-36765
The CreateHob() function aligns the requested size to 8
performing the following operation:
```
HobLength = (UINT16)((HobLength + 0x7) & (~0x7));
```
No checks are performed to ensure this value doesn't
overflow, and could lead to CreateHob() returning a smaller
HOB than requested, which could lead to OOB HOB accesses.
Reported-by: Marc Beatove <mbeatove@google.com>
Cc: Leif Lindholm <quic_llindhol@quicinc.com>
Reviewed-by: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Abner Chang <abner.chang@amd.com>
Cc: John Mathew <john.mathews@intel.com>
Authored-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Gua Guo <gua.guo@intel.com>
Diffstat (limited to 'UnitTestFrameworkPkg')
0 files changed, 0 insertions, 0 deletions