hw/uefi: fix heap overflow (CVE-2026-5744)
When copying the request response into the pio transfer buffer the code skips the 'struct mm_header' but does not consider that when calculating transfer size, so it will copy 24 (== sizeof(struct mm_header)) extra bytes, which can overflow uv->pio_xfer_buffer. Fix that by copying the complete buffer, including the header, which also makes the pio code path consistent with the (unaffected) dma code path. Fixes: CVE-2026-5744 Fixes: 90ca4e03c27d ("hw/uefi: add var-service-core.c") Reported-by: Yuma Kurogome <yumak@ricsec.co.jp> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-id: 20260408073403.3410541-1-kraxel@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gerd Hoffmann committed
Apr 8, 2026 at 09:34 UTC
af74c9e46bb55e2da042315a0c65666f59c61686
1 file changed
+2
-3
hw/uefi/var-service-core.c
+2
-3
@@ -137,9 +137,8 @@ static uint32_t uefi_vars_cmd_mm(uefi_vars_state *uv, bool dma_mode)
137
uv->buffer, sizeof(*mhdr) + mhdr->length,
138
MEMTXATTRS_UNSPECIFIED);
139
} else {
140
- memcpy(uv->pio_xfer_buffer + sizeof(*mhdr),
141
- uv->buffer + sizeof(*mhdr),
142
- sizeof(*mhdr) + mhdr->length);
140
+ memcpy(uv->pio_xfer_buffer,
141
+ uv->buffer, sizeof(*mhdr) + mhdr->length);
142
}
143
144
return retval;