hw/uefi: make SetupMode read-only
This is read-only variable which informs the OS about the secure boot state. Reject any attempts to write to it. Fixes: CVE-2026-16288 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4039 Acked-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260720143244.821889-7-kraxel@redhat.com>
Gerd Hoffmann committed
Jul 20, 2026 at 16:32 UTC
bd9b3c50f458ce24fee084916cf0eba58bd9a33b
1 file changed
+7
hw/uefi/var-service-auth.c
+7
@@ -298,6 +298,13 @@ efi_status uefi_vars_check_secure_boot(uefi_vars_state *uv, uefi_variable *var)
298
return EFI_WRITE_PROTECTED;
299
}
300
301
+ /* reject SetupMode updates */
302
+ if (qemu_uuid_is_equal(&var->guid, &EfiGlobalVariable) &&
303
+ uefi_str_equal(var->name, var->name_size,
304
+ name_setup_mode, sizeof(name_setup_mode))) {
305
+ return EFI_WRITE_PROTECTED;
306
+ }
307
+
308
return EFI_SUCCESS;
309
}
310