hw/uefi: account variable policy entries against storage size
uefi-vars already tracks (and limits) the memory footprint of UEFI variables. Do that for variable policies too. Fixes: CVE-2026-61405 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3890 Acked-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260720143244.821889-5-kraxel@redhat.com>
Gerd Hoffmann committed
Jul 20, 2026 at 16:32 UTC
8e0ddb4a6ebd1c3d2dfd067f82b6d92de5b23e30
2 files changed
+9
hw/uefi/var-service-policy.c
+5
@@ -283,7 +283,12 @@ static uint32_t uefi_vars_mm_check_policy_register(uefi_vars_state *uv,
283
return uefi_vars_mm_policy_error(mhdr, mchk, EFI_ALREADY_STARTED);
284
}
285
286
+ if (uv->used_storage + pe->size > uv->max_storage) {
287
+ return uefi_vars_mm_policy_error(mhdr, mchk, EFI_OUT_OF_RESOURCES);
288
+ }
289
+
290
uefi_vars_add_policy(uv, pe);
291
+ uv->used_storage += pe->size;
292
293
mchk->result = EFI_SUCCESS;
294
return sizeof(*mchk);
hw/uefi/var-service-vars.c
+4
@@ -201,11 +201,15 @@ void uefi_vars_clear_all(uefi_vars_state *uv)
201
void uefi_vars_update_storage(uefi_vars_state *uv)
202
{
203
uefi_variable *var;
204
+ uefi_var_policy *pol;
205
206
uv->used_storage = 0;
207
QTAILQ_FOREACH(var, &uv->variables, next) {
208
uv->used_storage += variable_size(var);
209
}
210
+ QTAILQ_FOREACH(pol, &uv->var_policies, next) {
211
+ uv->used_storage += pol->entry->size;
212
+ }
213
}
214
215
static gboolean check_access(uefi_vars_state *uv, uefi_variable *var)