hw/uefi: verify pio_xfer_offset before calculating buffer checksum
Without that it is possible to do trigger OOB reads by first advancing offset, then making the buffer smaller, finally asking for a checksum. Fixes: CVE-2026-41436 Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c") Reported-by: Katherine Leaver <katherine.j.leaver@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260422092910.444997-3-kraxel@redhat.com>
Gerd Hoffmann committed
Apr 22, 2026 at 11:29 UTC
94d9a8b2c9e6962aa7f7673229d2db7b110cfac6
1 file changed
+4
hw/uefi/var-service-core.c
+4
@@ -235,6 +235,10 @@ static uint64_t uefi_vars_read(void *opaque, hwaddr addr, unsigned size)
235
uv->pio_xfer_offset += size;
236
break;
237
case UEFI_VARS_REG_PIO_BUFFER_CRC32C:
238
+ if (uv->pio_xfer_offset > uv->buf_size) {
239
+ retval = 0;
240
+ break;
241
+ }
242
retval = crc32c(0xffffffff, uv->pio_xfer_buffer, uv->pio_xfer_offset);
243
break;
244
case UEFI_VARS_REG_FLAGS: