[edk2-devel] [PATCH] Package/Module: edk2-platforms\Features\Intel\UserInterface\UserAuthFeaturePkg

[Nayana Patel]

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4645

Clear out the variable SmmCommunicateSetPassword which contains password before 
goto Exit.
To avoid vulnerability.

Signed-off-by: Nayana Patel <nayana.pa...@intel.com>
---
 .../UserAuthenticationDxeSmm/UserAuthenticationSmm.c            | 2 ++
 1 file changed, 2 insertions(+)

diff --git 
a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c
 
b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c
index 98f40c1812..8d7c018688 100644
--- 
a/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c
+++ 
b/Features/Intel/UserInterface/UserAuthFeaturePkg/UserAuthenticationDxeSmm/UserAuthenticationSmm.c
@@ -499,6 +499,7 @@ SmmPasswordHandler (
     if (PasswordLen == sizeof(SmmCommunicateSetPassword.OldPassword)) {
       DEBUG ((DEBUG_ERROR, "SmmPasswordHandler: OldPassword invalid!\n"));
       Status = EFI_INVALID_PARAMETER;
+      ZeroMem (&SmmCommunicateSetPassword, sizeof (SmmCommunicateSetPassword));
       goto EXIT;
     }
 
@@ -510,6 +511,7 @@ SmmPasswordHandler (
       } else {
         Status = EFI_SECURITY_VIOLATION;
       }
+      ZeroMem (&SmmCommunicateSetPassword, sizeof (SmmCommunicateSetPassword));
       goto EXIT;
     }
 
-- 
2.26.2.windows.1



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#116869): https://edk2.groups.io/g/devel/message/116869
Mute This Topic: https://groups.io/mt/105014793/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-