linux-kernel - [PATCH] firmware: dmi: Fortify entry point length checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220907103041.0a88d5c4@endymion.delvare>
Date:   Wed, 7 Sep 2022 10:30:41 +0200
From:   Jean Delvare <jdelvare@...e.de>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Andy Shevchenko <andy.shevchenko@...il.com>
Subject: [PATCH] firmware: dmi: Fortify entry point length checks

Ensure that the SMBIOS entry point is long enough to include all the
fields we need. Otherwise it is pointless to even attempt to verify
its checksum.

Also fix the maximum length check, which is technically 32, not 31.
It does not matter in practice as the only valid values are 31 (for
SMBIOS 2.x) and 24 (for SMBIOS 3.x), but let's still have the check
right in case new fields are added to either structure in the future.

Signed-off-by: Jean Delvare <jdelvare@...e.de>
Reported-by: Linus Torvalds <torvalds@...ux-foundation.org>
Link: https://lore.kernel.org/lkml/20220823094857.27f3d924@endymion.delvare/T/
Cc: Andy Shevchenko <andy.shevchenko@...il.com>
---
 drivers/firmware/dmi_scan.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- linux-5.19.orig/drivers/firmware/dmi_scan.c	2022-09-06 15:22:44.279728845 +0200
+++ linux-5.19/drivers/firmware/dmi_scan.c	2022-09-07 10:16:55.743362320 +0200
@@ -568,7 +568,8 @@ static int __init dmi_present(const u8 *
 	u32 smbios_ver;
 
 	if (memcmp(buf, "_SM_", 4) == 0 &&
-	    buf[5] < 32 && dmi_checksum(buf, buf[5])) {
+	    buf[5] >= 31 && buf[5] <= 32 &&
+	    dmi_checksum(buf, buf[5])) {
 		smbios_ver = get_unaligned_be16(buf + 6);
 		smbios_entry_point_size = buf[5];
 		memcpy(smbios_entry_point, buf, smbios_entry_point_size);
@@ -629,7 +630,8 @@ static int __init dmi_present(const u8 *
 static int __init dmi_smbios3_present(const u8 *buf)
 {
 	if (memcmp(buf, "_SM3_", 5) == 0 &&
-	    buf[6] < 32 && dmi_checksum(buf, buf[6])) {
+	    buf[6] >= 24 && buf[6] <= 32 &&
+	    dmi_checksum(buf, buf[6])) {
 		dmi_ver = get_unaligned_be24(buf + 7);
 		dmi_num = 0;			/* No longer specified */
 		dmi_len = get_unaligned_le32(buf + 12);


-- 
Jean Delvare
SUSE L3 Support