https://github.com/rhboot/shim/commit/0226b56513b2b8bd5fd281bce77c40c9bf07c66d

Skip to content
Toggle navigation
 
Sign in

  * Product
      +  
        Actions
        Automate any workflow
      +  
        Packages
        Host and manage packages
      +  
        Security
        Find and fix vulnerabilities
      +  
        Codespaces
        Instant dev environments
      +  
        Copilot
        Write better code with AI
      +  
        Code review
        Manage code changes
      +  
        Issues
        Plan and track work
      +  
        Discussions
        Collaborate outside of code
    Explore
      + All features
      + Documentation
      + GitHub Skills
      + Blog
  * Solutions
    For
      + Enterprise
      + Teams
      + Startups
      + Education
    By Solution
      + CI/CD & Automation
      + DevOps
      + DevSecOps
    Resources
      + Learning Pathways
      + White papers, Ebooks, Webinars
      + Customer Stories
      + Partners
  * Open Source
      +  
        GitHub Sponsors
        Fund open source developers
      +  
        The ReadME Project
        GitHub community articles
    Repositories
      + Topics
      + Trending
      + Collections
  * Pricing

Search or jump to...

Search code, repositories, users, issues, pull requests...

Search
[                    ]
Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

[                    ] [ ] Include my email address so I can be
contacted
Cancel Submit feedback

Saved searches

Use saved searches to filter your results more quickly

Name [                    ] 
Query [                    ]

To see all available qualifiers, see our documentation.

Cancel Create saved search
Sign in
Sign up
You signed in with another tab or window. Reload to refresh your
session. You signed out in another tab or window. Reload to refresh
your session. You switched accounts on another tab or window. Reload
to refresh your session. Dismiss alert
{{ message }}
rhboot / shim Public

  * Notifications
  * Fork 264
  * Star 734

  * Code
  * Issues 99
  * Pull requests 24
  * Actions
  * Projects 0
  * Wiki
  * Security
  * Insights

Additional navigation options

  * Code
  * Issues
  * Pull requests
  * Actions
  * Projects
  * Wiki
  * Security
  * Insights

Commit

Permalink
This commit does not belong to any branch on this repository, and may
belong to a fork outside of the repository.
Browse files Browse the repository at this point in the history
CVE-2023-40547 - avoid incorrectly trusting HTTP headers

When retrieving files via HTTP or related protocols, shim attempts to
allocate a buffer to store the received data.  Unfortunately, this means
getting the size from an HTTP header, which can be manipulated to
specify a size that's smaller than the received data.  In this case, the
code accidentally uses the header for the allocation but the protocol
metadata to copy it from the rx buffer, resulting in an out-of-bounds
write.

This patch adds an additional check to test that the rx buffer is not
larger than the allocation.

Resolves: CVE-2023-40547
Reported-by: Bill Demirkapi, Microsoft Security Response Center
Signed-off-by: Peter Jones <pjones@redhat.com>

  * Loading branch information

@vathpela
vathpela committed Dec 5, 2023
1 parent e801b0d commit 0226b56
Showing 1 changed file with 7 additions and 1 deletion.
  * Whitespace
  * Ignore whitespace

  * Split
  * Unified

There are no files selected for viewing

8 changes: 7 additions & 1 deletion 8 httpboot.c
[*] Show comments
View file Edit file Delete file
This file contains bidirectional Unicode text that may be interpreted
or compiled differently than what appears below. To review, open the
file in an editor that reveals hidden Unicode characters. Learn more
about bidirectional Unicode characters
Show hidden characters

  Original     Diff
 file line     line                  Diff line change
   number     number
                      @@ -578,7 +578,13 @@ receive_http_response
 Expand Up            (EFI_HTTP_PROTOCOL *http, VOID **buffer, UINT64
                      *buf_size)
                      }
                      
                      if (*buf_size == 0) {
                      perror(L"Failed to get Content-Lenght\n");
                      perror(L"Failed to get Content-Length\n");
                      goto error;
                      }
                      
                      if (*buf_size < rx_message.BodyLength) {
                      efi_status = EFI_BAD_BUFFER_SIZE;
                      perror(L"Invalid Content-Length\n");
                      goto error;
                      }
                      
 Expand Down

Toggle all file notes Toggle all file annotations

0 comments on commit 0226b56

Please sign in to comment.

Footer

 (c) 2024 GitHub, Inc.

Footer navigation

  * Terms
  * Privacy
  * Security
  * Status
  * Docs
  * Contact
  * Manage cookies
  * Do not share my personal information

You can't perform that action at this time.