hw/uefi: check auth.hdr_length minimum size
auth.hdr_length maximum is already checked (against buffer size). The header has some fixed fields which are included in the header length, so there also is a minimum size which must be verified. Add a check for that. Fixes possible integer underflow. While being at it replace the magic number '24' with sizeof calculations for better code documentation. Fixes: CVE-2026-8341 Fixes: f1488fac0584 ("hw/uefi: add var-service-auth.c") Reported-by: Feifan Qian <bea1e@proton.me> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260512060523.17493-1-kraxel@redhat.com>
Gerd Hoffmann committed
May 12, 2026 at 08:05 UTC
b33fd8ab1caa07aeb290ef5dac44a4e7fd4be02b
2 files changed
+6
-3
hw/uefi/var-service-auth.c
+4
-1
@@ -194,7 +194,7 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars_state *uv,
194
return EFI_SUCCESS;
195
}
196
197
- if (auth.hdr_length == 24) {
197
+ if (auth.hdr_length == (sizeof(auth) - sizeof(auth.timestamp))) {
198
/* no signature (auth->cert_data is empty) */
199
return EFI_SECURITY_VIOLATION;
200
}
@@ -228,6 +228,9 @@ efi_status uefi_vars_check_auth_2(uefi_vars_state *uv, uefi_variable *var,
228
}
229
memcpy(&auth, data, sizeof(auth));
230
231
+ if (auth.hdr_length < (sizeof(auth) - sizeof(auth.timestamp))) {
232
+ return EFI_SECURITY_VIOLATION;
233
+ }
234
if (uadd64_overflow(sizeof(efi_time), auth.hdr_length, &data_offset)) {
235
return EFI_SECURITY_VIOLATION;
236
}
hw/uefi/var-service-pkcs7.c
+2
-2
@@ -113,9 +113,9 @@ static gnutls_datum_t *build_pkcs7(void *data)
113
114
memcpy(&auth, data, sizeof(auth));
115
pkcs7 = g_new(gnutls_datum_t, 1);
116
- pkcs7->size = auth.hdr_length - 24;
116
+ pkcs7->size = auth.hdr_length - (sizeof(auth) - sizeof(auth.timestamp));
117
pkcs7->data = g_malloc(pkcs7->size);
118
- memcpy(pkcs7->data, data + 16 + 24, pkcs7->size);
118
+ memcpy(pkcs7->data, data + sizeof(auth), pkcs7->size);
119
120
wrap_pkcs7(pkcs7);
121