From 5e93f6c09a57dd69f1b05654455452c4a0154a79 Mon Sep 17 00:00:00 2001 From: Jon Maloy Date: Thu, 13 Jun 2024 18:35:46 -0400 Subject: [PATCH 3/8] NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Jon Maloy RH-MergeRequest: 75: NetworkPkg: SECURITY PATCH CVE-2023-45236 and CVE-2023-45237 RH-Jira: RHEL-40270 RHEL-40272 RH-Acked-by: Gerd Hoffmann RH-Commit: [3/8] 9307e82e90d6f526d303607255a4c469ebe574d4 JIRA: https://issues.redhat.com/browse/RHEL-40272 Upstream: Merged CVE: CVE-2023-45236 commit ced13b93afea87a8a1fe6ddbb67240a84cb2e3d3 Author: Sam Date: Wed May 29 07:46:03 2024 +0800 NetworkPkg TcpDxe: Fixed system stuck on PXE boot flow in iPXE environment This bug fix is based on the following commit "NetworkPkg TcpDxe: SECURITY PATCH" REF: 1904a64 Issue Description: An "Invalid handle" error was detected during runtime when attempting to destroy a child instance of the hashing protocol. The problematic code segment was: NetworkPkg\TcpDxe\TcpDriver.c Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, ​&mHash2ServiceHandle); Root Cause Analysis: The root cause of the error was the passing of an incorrect parameter type, a pointer to an EFI_HANDLE instead of an EFI_HANDLE itself, to the DestroyChild function. This mismatch resulted in the function receiving an invalid handle. Implemented Solution: To resolve this issue, the function call was corrected to pass mHash2ServiceHandle directly: NetworkPkg\TcpDxe\TcpDriver.c Status = Hash2ServiceBinding->DestroyChild(Hash2ServiceBinding, mHash2ServiceHandle); This modification ensures the correct handle type is used, effectively rectifying the "Invalid handle" error. Verification: Testing has been conducted, confirming the efficacy of the fix. Additionally, the BIOS can boot into the OS in an iPXE environment. Cc: Doug Flick [MSFT] Signed-off-by: Sam Tsai [Wiwynn] Reviewed-by: Saloni Kasbekar Signed-off-by: Jon Maloy --- NetworkPkg/TcpDxe/TcpDriver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NetworkPkg/TcpDxe/TcpDriver.c b/NetworkPkg/TcpDxe/TcpDriver.c index 40bba4080c..c6e7c0df54 100644 --- a/NetworkPkg/TcpDxe/TcpDriver.c +++ b/NetworkPkg/TcpDxe/TcpDriver.c @@ -509,7 +509,7 @@ TcpDestroyService ( // // Destroy the instance of the hashing protocol for this controller. // - Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, &mHash2ServiceHandle); + Status = Hash2ServiceBinding->DestroyChild (Hash2ServiceBinding, mHash2ServiceHandle); if (EFI_ERROR (Status)) { return EFI_UNSUPPORTED; } -- 2.39.3