hw/uefi: add sanity check
Verify the passed buffer has the minimal required length before reading the size field + verifying the total length. Fixes: CVE-2026-58581 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3614 Acked-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260720143244.821889-2-kraxel@redhat.com>
Gerd Hoffmann committed
Jul 20, 2026 at 16:32 UTC
702216619e2a1afd5039520114f4d245d7011f09
1 file changed
+3
hw/uefi/var-service-policy.c
+3
@@ -276,6 +276,9 @@ static uint32_t uefi_vars_mm_check_policy_register(uefi_vars_state *uv,
276
uefi_var_policy *pol;
277
uint64_t length;
278
279
+ if (mhdr->length < sizeof(*mchk) + sizeof(*pe)) {
280
+ return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE);
281
+ }
282
if (uadd64_overflow(sizeof(*mchk), pe->size, &length)) {
283
return uefi_vars_mm_policy_error(mhdr, mchk, EFI_BAD_BUFFER_SIZE);
284
}