hw/uefi: add name_size check to uefi_vars_mm_lock_variable()
Make sure the total variable_policy_entry size stays below 64k so the (16-bit) size field can not wrap. Fixes: CVE-2026-41438 Fixes: db1ecfb473ac ("hw/uefi: add var-service-vars.c") Reported-by: Katherine Leaver <katherine.j.leaver@gmail.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-ID: <20260422092910.444997-5-kraxel@redhat.com>
Gerd Hoffmann committed
Apr 22, 2026 at 11:29 UTC
c45b460d16f991ff3f753623f3423e1adc4077a2
1 file changed
+3
hw/uefi/var-service-vars.c
+3
@@ -667,6 +667,9 @@ uefi_vars_mm_lock_variable(uefi_vars_state *uv, mm_header *mhdr,
667
if (mhdr->length < length) {
668
return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE);
669
}
670
+ if (sizeof(*pe) + lv->name_size > UINT16_MAX) {
671
+ return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE);
672
+ }
673
674
uefi_trace_variable(__func__, lv->guid, name, lv->name_size);
675