mirror of
https://github.com/tianocore/edk2
synced 2026-08-27 00:23:19 -04:00
6a55e01aba
`ProcessCommunicationBuffer()` computes BufferSize by adding a fixed offset (24 bytes) to an attacker-controlled MessageLength (UINT64): `BufferSize = OFFSET_OF(EFI_MM_COMMUNICATE_HEADER, Data) + CommunicateHeader->MessageLength;` When `MessageLength >= 0xFFFFFFFFFFFFFFE8`, the addition wraps to a small value (0–23 bytes) after UINTN truncation. The subsequent bounds check evaluates FALSE on the wrapped value, bypassing size validation and allowing CopyMem to proceed with a corrupted size into the fixed MM communication buffer. This change added an overflow check before the addition - rejects with EFI_INVALID_PARAMETER if `MessageLength` is greater than `MAX_UINTN - OFFSET_OF(EFI_MM_COMMUNICATE_HEADER, Data).` Co-authored-by: Gowtham Manikandan <gowthammanikandan@ami.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com>
140 lines
6.2 KiB
C
140 lines
6.2 KiB
C
/** @file
|
|
|
|
Copyright (c) 2024, Intel Corporation. All rights reserved.<BR>
|
|
SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
|
|
**/
|
|
|
|
#pragma once
|
|
|
|
#include <PiDxe.h>
|
|
|
|
#include <Library/BaseLib.h>
|
|
#include <Library/DebugLib.h>
|
|
#include <Library/HobLib.h>
|
|
#include <Library/PcdLib.h>
|
|
#include <Library/UefiLib.h>
|
|
#include <Library/UefiBootServicesTableLib.h>
|
|
#include <Library/BaseMemoryLib.h>
|
|
#include <Library/MemoryAllocationLib.h>
|
|
#include <Library/UefiRuntimeLib.h>
|
|
#include <Library/ReportStatusCodeLib.h>
|
|
#include <Library/SafeIntLib.h>
|
|
|
|
#include <Protocol/SmmControl2.h>
|
|
#include <Protocol/MmCommunication3.h>
|
|
#include <Protocol/MmCommunication2.h>
|
|
#include <Protocol/MmCommunication.h>
|
|
#include <Protocol/SmmAccess2.h>
|
|
|
|
#include <Guid/MmCommBuffer.h>
|
|
|
|
/**
|
|
Communicates with a registered handler.
|
|
|
|
This function provides a service to send and receive messages from a registered UEFI service.
|
|
|
|
@param[in] This The EFI_MM_COMMUNICATION3_PROTOCOL instance.
|
|
@param[in, out] CommBufferPhysical Physical address of the MM communication buffer, of which content must
|
|
start with EFI_MM_COMMUNICATE_HEADER_V3.
|
|
@param[in, out] CommBufferVirtual Virtual address of the MM communication buffer, of which content must
|
|
start with EFI_MM_COMMUNICATE_HEADER_V3.
|
|
|
|
@retval EFI_SUCCESS The message was successfully posted.
|
|
@retval EFI_INVALID_PARAMETER CommBufferPhysical was NULL or CommBufferVirtual was NULL.
|
|
@retval EFI_BAD_BUFFER_SIZE The buffer is too large for the MM implementation.
|
|
If this error is returned, the MessageSize field
|
|
in the CommBuffer header, are updated to reflect
|
|
the maximum payload size the implementation can accommodate.
|
|
@retval EFI_ACCESS_DENIED The CommunicateBuffer parameter are in address range
|
|
that cannot be accessed by the MM environment.
|
|
|
|
**/
|
|
EFI_STATUS
|
|
EFIAPI
|
|
MmCommunicate3 (
|
|
IN CONST EFI_MM_COMMUNICATION3_PROTOCOL *This,
|
|
IN OUT VOID *CommBufferPhysical,
|
|
IN OUT VOID *CommBufferVirtual
|
|
);
|
|
|
|
/**
|
|
Communicates with a registered handler.
|
|
|
|
This function provides a service to send and receive messages from a registered UEFI service.
|
|
|
|
@param[in] This The EFI_MM_COMMUNICATION_PROTOCOL instance.
|
|
@param[in, out] CommBufferPhysical Physical address of the MM communication buffer.
|
|
@param[in, out] CommBufferVirtual Virtual address of the MM communication buffer.
|
|
@param[in, out] CommSize The size of the data buffer being passed in. On exit, the size of data
|
|
being returned. Zero if the handler does not wish to reply with any data.
|
|
This parameter is optional and may be NULL.
|
|
|
|
@retval EFI_SUCCESS The message was successfully posted.
|
|
@retval EFI_INVALID_PARAMETER The CommBuffer was NULL.
|
|
@retval EFI_BAD_BUFFER_SIZE The buffer is too large for the MM implementation.
|
|
If this error is returned, the MessageLength field
|
|
in the CommBuffer header or the integer pointed by
|
|
CommSize, are updated to reflect the maximum payload
|
|
size the implementation can accommodate.
|
|
@retval EFI_ACCESS_DENIED The CommunicateBuffer parameter or CommSize parameter,
|
|
if not omitted, are in address range that cannot be
|
|
accessed by the MM environment.
|
|
|
|
**/
|
|
EFI_STATUS
|
|
EFIAPI
|
|
MmCommunicate2 (
|
|
IN CONST EFI_MM_COMMUNICATION2_PROTOCOL *This,
|
|
IN OUT VOID *CommBufferPhysical,
|
|
IN OUT VOID *CommBufferVirtual,
|
|
IN OUT UINTN *CommSize OPTIONAL
|
|
);
|
|
|
|
/**
|
|
Communicates with a registered handler.
|
|
|
|
This function provides a service to send and receive messages from a registered UEFI service.
|
|
|
|
@param[in] This The EFI_MM_COMMUNICATION_PROTOCOL instance.
|
|
@param[in, out] CommBufferPhysical Physical address of the MM communication buffer
|
|
@param[in, out] CommSize The size of the data buffer being passed in. On exit, the size of data
|
|
being returned. Zero if the handler does not wish to reply with any data.
|
|
This parameter is optional and may be NULL.
|
|
|
|
@retval EFI_SUCCESS The message was successfully posted.
|
|
@retval EFI_INVALID_PARAMETER The CommBuffer was NULL.
|
|
@retval EFI_BAD_BUFFER_SIZE The buffer is too large for the MM implementation.
|
|
If this error is returned, the MessageLength field
|
|
in the CommBuffer header or the integer pointed by
|
|
CommSize, are updated to reflect the maximum payload
|
|
size the implementation can accommodate.
|
|
@retval EFI_ACCESS_DENIED The CommunicateBuffer parameter or CommSize parameter,
|
|
if not omitted, are in address range that cannot be
|
|
accessed by the MM environment.
|
|
|
|
**/
|
|
EFI_STATUS
|
|
EFIAPI
|
|
MmCommunicate (
|
|
IN CONST EFI_MM_COMMUNICATION_PROTOCOL *This,
|
|
IN OUT VOID *CommBufferPhysical,
|
|
IN OUT UINTN *CommSize OPTIONAL
|
|
);
|
|
|
|
/**
|
|
Notification function of EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE.
|
|
|
|
This is a notification function registered on EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
|
|
It convers pointer to new virtual address.
|
|
|
|
@param[in] Event Event whose notification function is being invoked.
|
|
@param[in] Context Pointer to the notification function's context.
|
|
|
|
**/
|
|
VOID
|
|
EFIAPI
|
|
MmVirtualAddressChangeEvent (
|
|
IN EFI_EVENT Event,
|
|
IN VOID *Context
|
|
);
|