Sounds good. Thanks. Reviewed-by: Jiewen Yao <[email protected]>
> -----Original Message----- > From: [email protected] <[email protected]> > Sent: Monday, March 20, 2023 11:00 PM > To: [email protected]; Yao, Jiewen <[email protected]> > Cc: Pawel Polawski <[email protected]>; Wang, Jian J > <[email protected]>; Oliver Steffen <[email protected]>; Xu, Min M > <[email protected]>; Marvin Häuser <[email protected]>; > [email protected] > Subject: Re: [edk2-devel] [PATCH v2 1/1] > SecurityPkg/DxeImageVerificationLib: Check result of GetEfiGlobalVariable2 > > On Mon, Mar 20, 2023 at 01:20:29PM +0000, Yao, Jiewen wrote: > > Would you please share with us what test has been done for this patch? > > Usual regression testing, including booting images with and without > secure boot. Additionally checked images with the wrong signature > are rejected (try boot grub.efi directly instead of using the > shim.efi -> grub.efi chain). > > take care, > Gerd > > > > > Thank you > > Yao, Jiewen > > > > > -----Original Message----- > > > From: [email protected] <[email protected]> On Behalf Of Gerd > > > Hoffmann > > > Sent: Monday, March 20, 2023 6:02 PM > > > To: [email protected] > > > Cc: Pawel Polawski <[email protected]>; Wang, Jian J > > > <[email protected]>; Oliver Steffen <[email protected]>; Xu, > Min M > > > <[email protected]>; Marvin Häuser <[email protected]>; Yao, > > > Jiewen <[email protected]>; [email protected] > > > Subject: Re: [edk2-devel] [PATCH v2 1/1] > > > SecurityPkg/DxeImageVerificationLib: Check result of > GetEfiGlobalVariable2 > > > > > > On Fri, Mar 03, 2023 at 11:35:53AM +0100, Gerd Hoffmann wrote: > > > > Call gRT->GetVariable() directly to read the SecureBoot variable. It is > > > > one byte in size so we can easily place it on the stack instead of > > > > having GetEfiGlobalVariable2() allocate it for us, which avoids a few > > > > possible error cases. > > > > > > > > Skip secure boot checks if (and only if): > > > > > > > > (a) the SecureBoot variable is not present (EFI_NOT_FOUND) according > to > > > > the return value, or > > > > (b) the SecureBoot variable was read successfully and is set to > > > > SECURE_BOOT_MODE_DISABLE. > > > > > > > > Previously the code skipped the secure boot checks on *any* > > > > gRT->GetVariable() error (GetEfiGlobalVariable2 sets the variable > > > > value to NULL in that case) and also on memory allocation failures. > > > > > > > > Fixes: CVE-2019-14560 > > > > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=2167 > > > > Signed-off-by: Gerd Hoffmann <[email protected]> > > > > > > Ping. Any comments on this patch? > > > > > > take care, > > > Gerd > > > > > > > > > > > > > > > > > > > > > > > > > > > > > -- -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#101466): https://edk2.groups.io/g/devel/message/101466 Mute This Topic: https://groups.io/mt/97359253/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
