mirror of
https://github.com/tianocore/edk2
synced 2026-08-27 00:23:19 -04:00
6a55e01aba
`ProcessCommunicationBuffer()` computes BufferSize by adding a fixed offset (24 bytes) to an attacker-controlled MessageLength (UINT64): `BufferSize = OFFSET_OF(EFI_MM_COMMUNICATE_HEADER, Data) + CommunicateHeader->MessageLength;` When `MessageLength >= 0xFFFFFFFFFFFFFFE8`, the addition wraps to a small value (0–23 bytes) after UINTN truncation. The subsequent bounds check evaluates FALSE on the wrapped value, bypassing size validation and allowing CopyMem to proceed with a corrupted size into the fixed MM communication buffer. This change added an overflow check before the addition - rejects with EFI_INVALID_PARAMETER if `MessageLength` is greater than `MAX_UINTN - OFFSET_OF(EFI_MM_COMMUNICATE_HEADER, Data).` Co-authored-by: Gowtham Manikandan <gowthammanikandan@ami.com> Signed-off-by: Kun Qin <kun.qin@microsoft.com>
55 lines
1.4 KiB
INI
55 lines
1.4 KiB
INI
## @file
|
|
# MmCommunicationDxe driver produces MmCommunication protocol and
|
|
# create the notifications of some protocols and event.
|
|
#
|
|
# Copyright (c) 2024, Intel Corporation. All rights reserved.<BR>
|
|
#
|
|
# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
#
|
|
##
|
|
|
|
[Defines]
|
|
INF_VERSION = 0x0001001A
|
|
BASE_NAME = MmCommunicationDxe
|
|
FILE_GUID = 8d4b8bc7-e66b-4be2-add8-4988e08743ed
|
|
MODULE_TYPE = DXE_RUNTIME_DRIVER
|
|
VERSION_STRING = 1.0
|
|
PI_SPECIFICATION_VERSION = 0x00010032
|
|
ENTRY_POINT = MmCommunicationEntryPoint
|
|
|
|
[Sources]
|
|
MmCommunicationDxe.c
|
|
MmCommunicationDxe.h
|
|
|
|
[Packages]
|
|
MdePkg/MdePkg.dec
|
|
MdeModulePkg/MdeModulePkg.dec
|
|
UefiCpuPkg/UefiCpuPkg.dec
|
|
StandaloneMmPkg/StandaloneMmPkg.dec
|
|
|
|
[LibraryClasses]
|
|
UefiDriverEntryPoint
|
|
BaseLib
|
|
DebugLib
|
|
HobLib
|
|
BaseMemoryLib
|
|
MemoryAllocationLib
|
|
UefiBootServicesTableLib
|
|
UefiLib
|
|
UefiRuntimeLib
|
|
ReportStatusCodeLib
|
|
SafeIntLib
|
|
[Guids]
|
|
gMmCommBufferHobGuid
|
|
gEfiEventVirtualAddressChangeGuid
|
|
gEfiMmCommunicateHeaderV3Guid
|
|
|
|
[Protocols]
|
|
gEfiMmCommunication3ProtocolGuid
|
|
gEfiMmCommunication2ProtocolGuid
|
|
gEfiSmmControl2ProtocolGuid
|
|
gEfiMmCommunicationProtocolGuid
|
|
gEfiSmmAccess2ProtocolGuid
|
|
|
|
[Depex]
|
|
gEfiSmmAccess2ProtocolGuid AND gEfiSmmControl2ProtocolGuid
|