MSVSphere Packaging Team
1 year ago
parent
d5a9d58758
commit
1327dfceea
@ -1,3 +1,2 @@
|
|||||||
fdcb04021414cdd5a7e286058ca36aca359d323d SOURCES/RedHatSecureBootPkKek1.pem
|
|
||||||
ae830c7278f985cb25e90f4687b46c8b22316bef SOURCES/edk2-bb1bba3d77.tar.xz
|
ae830c7278f985cb25e90f4687b46c8b22316bef SOURCES/edk2-bb1bba3d77.tar.xz
|
||||||
df2e14a45d968b590194d82736fcbfe2be10d1b0 SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
|
df2e14a45d968b590194d82736fcbfe2be10d1b0 SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
|
||||||
|
|||||||
@ -1,3 +1,2 @@
|
|||||||
SOURCES/RedHatSecureBootPkKek1.pem
|
|
||||||
SOURCES/edk2-bb1bba3d77.tar.xz
|
SOURCES/edk2-bb1bba3d77.tar.xz
|
||||||
SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
|
SOURCES/openssl-rhel-d00c3c5b8a9d6d3ea3dabfcafdf36afd61ba8bcc.tar.xz
|
||||||
|
|||||||
@ -0,0 +1,22 @@
|
|||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDoDCCAoigAwIBAgIJAP71iOjzlsDxMA0GCSqGSIb3DQEBCwUAMFExKzApBgNV
|
||||||
|
BAMTIlJlZCBIYXQgU2VjdXJlIEJvb3QgKFBLL0tFSyBrZXkgMSkxIjAgBgkqhkiG
|
||||||
|
9w0BCQEWE3NlY2FsZXJ0QHJlZGhhdC5jb20wHhcNMTQxMDMxMTExNTM3WhcNMzcx
|
||||||
|
MDI1MTExNTM3WjBRMSswKQYDVQQDEyJSZWQgSGF0IFNlY3VyZSBCb290IChQSy9L
|
||||||
|
RUsga2V5IDEpMSIwIAYJKoZIhvcNAQkBFhNzZWNhbGVydEByZWRoYXQuY29tMIIB
|
||||||
|
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkB+Ee42865cmgm2Iq4rJjGhw
|
||||||
|
+d9LB7I3gwsCyGdoMJ7j8PCZSrhZV8ZB9jiL/mZMSek3N5IumAEeWxRQ5qiNJQ31
|
||||||
|
huarMMtAFuqNixaGcEM38s7Akd9xFI6ZDom2TG0kHozkL08l0LoG+MboGRh2cx2B
|
||||||
|
bajYBc86yHsoyDajFg0pjJmaaNyrwE2Nv1q7K6k5SwSXHPk2u8U6hgSur9SCe+Cr
|
||||||
|
3kkFaPz2rmgabJBNVxk8ZGYD9sdSm/eUz5NqoWjJqs+Za7yqXgjnORz3+A+6Bn7x
|
||||||
|
y+h23f4i2q06Xls06rPJ4E0EKX64YLkF77XZF1hWFmC5MDLwNkrD8nmNEkBw8wID
|
||||||
|
AQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVy
|
||||||
|
YXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUPOlg4/8ZoQp7o0L0jUIutNWccuww
|
||||||
|
HwYDVR0jBBgwFoAUPOlg4/8ZoQp7o0L0jUIutNWccuwwDQYJKoZIhvcNAQELBQAD
|
||||||
|
ggEBAFxNkoi0gl8drYsR7N8GpnqlK583VQyNbgUArbcMQYlpz9ZlBptReNKtx7+c
|
||||||
|
3AVzf+ceORO06rYwfUB1q5xDC9+wwhu/MOD0/sDbYiGY9sWv3jtPSQrmHvmGsD8N
|
||||||
|
1tRGN9tUdF7/EcJgxnBYxRxv7LLYbm/DvDOHOKTzRGScNDsolCZ4J58WF+g7aQol
|
||||||
|
qXM2fp43XOzoP9uR+RKzPc7n3RXDrowFIGGbld6br/qxXBzll+fDNBGF9YonJqRw
|
||||||
|
NuwM9oM9kPc28/nzFdSQYr5TtK/TSa/v9HPoe3bkRCo3uoGkmQw6MSRxoOTktxrL
|
||||||
|
R+SqIs/vdWGA40O3SFdzET14m2k=
|
||||||
|
-----END CERTIFICATE-----
|
||||||
@ -0,0 +1,109 @@
|
|||||||
|
From bb0f29580825e60a5dc5c67e260dd20258eb71b0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jon Maloy <jmaloy@redhat.com>
|
||||||
|
Date: Wed, 29 Mar 2023 11:52:52 -0400
|
||||||
|
Subject: [PATCH] SecurityPkg/DxeImageVerificationLib: Check result of
|
||||||
|
GetEfiGlobalVariable2
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
||||||
|
RH-MergeRequest: 22: SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2
|
||||||
|
RH-Bugzilla: 1861743
|
||||||
|
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
RH-Commit: [1/1] 70e1ae5e2c7c148fc23160acdd360c044df5f4ff
|
||||||
|
|
||||||
|
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1861743
|
||||||
|
Upstream: Merged
|
||||||
|
CVE: CVE-2019-14560
|
||||||
|
|
||||||
|
commit 494127613b36e870250649b02cd4ce5f1969d9bd
|
||||||
|
Author: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
Date: Fri Mar 3 18:35:53 2023 +0800
|
||||||
|
|
||||||
|
SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2
|
||||||
|
|
||||||
|
Call gRT->GetVariable() directly to read the SecureBoot variable. It is
|
||||||
|
one byte in size so we can easily place it on the stack instead of
|
||||||
|
having GetEfiGlobalVariable2() allocate it for us, which avoids a few
|
||||||
|
possible error cases.
|
||||||
|
|
||||||
|
Skip secure boot checks if (and only if):
|
||||||
|
|
||||||
|
(a) the SecureBoot variable is not present (EFI_NOT_FOUND) according to
|
||||||
|
the return value, or
|
||||||
|
(b) the SecureBoot variable was read successfully and is set to
|
||||||
|
SECURE_BOOT_MODE_DISABLE.
|
||||||
|
|
||||||
|
Previously the code skipped the secure boot checks on *any*
|
||||||
|
gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable
|
||||||
|
value to NULL in that case) and also on memory allocation failures.
|
||||||
|
|
||||||
|
Fixes: CVE-2019-14560
|
||||||
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
Suggested-by: Marvin Häuser <mhaeuser@posteo.de>
|
||||||
|
Reviewed-by: Min Xu <min.m.xu@intel.com>
|
||||||
|
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
|
||||||
|
|
||||||
|
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
||||||
|
---
|
||||||
|
.../DxeImageVerificationLib.c | 18 ++++++++++++------
|
||||||
|
1 file changed, 12 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
|
||||||
|
index c48861cd64..1252927664 100644
|
||||||
|
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
|
||||||
|
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
|
||||||
|
@@ -1650,7 +1650,8 @@ DxeImageVerificationHandler (
|
||||||
|
EFI_IMAGE_EXECUTION_ACTION Action;
|
||||||
|
WIN_CERTIFICATE *WinCertificate;
|
||||||
|
UINT32 Policy;
|
||||||
|
- UINT8 *SecureBoot;
|
||||||
|
+ UINT8 SecureBoot;
|
||||||
|
+ UINTN SecureBootSize;
|
||||||
|
PE_COFF_LOADER_IMAGE_CONTEXT ImageContext;
|
||||||
|
UINT32 NumberOfRvaAndSizes;
|
||||||
|
WIN_CERTIFICATE_EFI_PKCS *PkcsCertData;
|
||||||
|
@@ -1665,6 +1666,8 @@ DxeImageVerificationHandler (
|
||||||
|
RETURN_STATUS PeCoffStatus;
|
||||||
|
EFI_STATUS HashStatus;
|
||||||
|
EFI_STATUS DbStatus;
|
||||||
|
+ EFI_STATUS VarStatus;
|
||||||
|
+ UINT32 VarAttr;
|
||||||
|
BOOLEAN IsFound;
|
||||||
|
|
||||||
|
SignatureList = NULL;
|
||||||
|
@@ -1720,22 +1723,25 @@ DxeImageVerificationHandler (
|
||||||
|
CpuDeadLoop ();
|
||||||
|
}
|
||||||
|
|
||||||
|
- GetEfiGlobalVariable2 (EFI_SECURE_BOOT_MODE_NAME, (VOID**)&SecureBoot, NULL);
|
||||||
|
+ SecureBootSize = sizeof (SecureBoot);
|
||||||
|
+ VarStatus = gRT->GetVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &VarAttr, &SecureBootSize, &SecureBoot);
|
||||||
|
//
|
||||||
|
// Skip verification if SecureBoot variable doesn't exist.
|
||||||
|
//
|
||||||
|
- if (SecureBoot == NULL) {
|
||||||
|
+ if (VarStatus == EFI_NOT_FOUND) {
|
||||||
|
return EFI_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// Skip verification if SecureBoot is disabled but not AuditMode
|
||||||
|
//
|
||||||
|
- if (*SecureBoot == SECURE_BOOT_MODE_DISABLE) {
|
||||||
|
- FreePool (SecureBoot);
|
||||||
|
+ if ((VarStatus == EFI_SUCCESS) &&
|
||||||
|
+ (VarAttr == (EFI_VARIABLE_BOOTSERVICE_ACCESS |
|
||||||
|
+ EFI_VARIABLE_RUNTIME_ACCESS)) &&
|
||||||
|
+ (SecureBoot == SECURE_BOOT_MODE_DISABLE))
|
||||||
|
+ {
|
||||||
|
return EFI_SUCCESS;
|
||||||
|
}
|
||||||
|
- FreePool (SecureBoot);
|
||||||
|
|
||||||
|
//
|
||||||
|
// Read the Dos header.
|
||||||
|
--
|
||||||
|
2.39.1
|
||||||
|
|
||||||
@ -0,0 +1,49 @@
|
|||||||
|
From c32f4994552ea5835cf00ce06f2f7d88c71249e5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
Date: Tue, 28 Feb 2023 15:47:00 +0100
|
||||||
|
Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
|
||||||
|
|
||||||
|
RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
|
||||||
|
RH-MergeRequest: 29: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
|
||||||
|
RH-Bugzilla: 2150267
|
||||||
|
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
||||||
|
RH-Acked-by: Jon Maloy <jmaloy@redhat.com>
|
||||||
|
RH-Commit: [1/1] e7e332ac0e6edf207b1b9692f2e1aed4a1fe7c0c
|
||||||
|
|
||||||
|
In case the number of CPUs can in increase beyond 255
|
||||||
|
due to CPU hotplug choose x2apic mode.
|
||||||
|
|
||||||
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
---
|
||||||
|
UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
|
||||||
|
1 file changed, 7 insertions(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
||||||
|
index b9a06747ed..177d15ab5b 100644
|
||||||
|
--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
||||||
|
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
||||||
|
@@ -495,7 +495,9 @@ CollectProcessorCount (
|
||||||
|
//
|
||||||
|
// Enable x2APIC mode if
|
||||||
|
// 1. Number of CPU is greater than 255; or
|
||||||
|
- // 2. There are any logical processors reporting an Initial APIC ID of 255 or greater.
|
||||||
|
+ // 2. The platform exposed the exact *boot* CPU count to us in advance, and
|
||||||
|
+ // more than 255 logical processors are possible later, with hotplug; or
|
||||||
|
+ // 3. There are any logical processors reporting an Initial APIC ID of 255 or greater.
|
||||||
|
//
|
||||||
|
X2Apic = FALSE;
|
||||||
|
if (CpuMpData->CpuCount > 255) {
|
||||||
|
@@ -503,6 +505,10 @@ CollectProcessorCount (
|
||||||
|
// If there are more than 255 processor found, force to enable X2APIC
|
||||||
|
//
|
||||||
|
X2Apic = TRUE;
|
||||||
|
+ } else if ((PcdGet32 (PcdCpuBootLogicalProcessorNumber) > 0) &&
|
||||||
|
+ (PcdGet32 (PcdCpuMaxLogicalProcessorNumber) > 255))
|
||||||
|
+ {
|
||||||
|
+ X2Apic = TRUE;
|
||||||
|
} else {
|
||||||
|
CpuInfoInHob = (CPU_INFO_IN_HOB *) (UINTN) CpuMpData->CpuInfoInHob;
|
||||||
|
for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
||||||
Loading…
Reference in new issue