1 line
3.7 KiB
JSON
1 line
3.7 KiB
JSON
{"id": "GHSA-hm2w-vr2p-hq7w", "cve": null, "repo": "theopolis/uefi-firmware-parser", "cwes": ["CWE-787"], "vuln_files": ["uefi_firmware/compression/Tiano/Decompress.c"], "duration_sec": 135, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Out-of-bounds write in ReadCLen: attacker-controlled run-length fills mCLen[] past NC with no bounds check", "file": "uefi_firmware/compression/Tiano/Decompress.c", "line": 525, "cwe": "CWE-787"}, {"fileMatch": true, "lineProx": true, "cweMatch": false, "hit": true, "title": "GetInfo reports DstSize purely from attacker-controlled header (size mismatch / undersized output buffer risk)", "file": "uefi_firmware/compression/Tiano/Decompress.c", "line": 717, "cwe": "CWE-130"}], "n_findings": 2, "findings": [{"title": "Out-of-bounds write in ReadCLen: attacker-controlled run-length fills mCLen[] past NC with no bounds check", "file": "uefi_firmware/compression/Tiano/Decompress.c", "line": 525, "cwe": "CWE-787", "vuln_class": "out-of-bounds-write", "severity": "critical", "description": "In ReadCLen(), the symbol count `Number` is read from 9 attacker-controlled bits (GetBits(Sd, CBIT), CBIT=9 => up to 511) and the outer loop runs `while (Index < Number)`. Inside, when the decoded CharC<=2 it performs a run-length zero-fill: for CharC==2 the run length is `GetBits(Sd, CBIT) + 20` (up to 531) and the inner loop `while ((INT16)CharC >= 0) Sd->mCLen[Index++] = 0;` advances Index by up to ~531 in a single outer iteration. There is NO `Index >= NC` bound check anywhere in ReadCLen (NC=510, mCLen is UINT8 mCLen[510]). Because the outer bound is only re-checked between iterations and Index can jump by hundreds at a time, Index can be driven far beyond NC, writing zero bytes well past mCLen[] into the adjacent struct members (mPTLen, mCTable, mPTTable) and past the end of the SCRATCH_DATA scratch allocation. All inputs flow unvalidated from the compressed source buffer (Decompress -> Decode -> DecodeC -> ReadCLen) which is attacker-controlled firmware. Note the maintainer added a guard in MakeTable (Index>=TableSize) and a DataIdx check in Decode, but the analogous Index>=NC guard required in ReadCLen is missing (it exists in upstream/fixed EDK2). The line 531 single-byte write path is also unguarded.", "poc": "Provide a crafted EFI/Tiano compressed blob to EfiDecompress()/TianoDecompress(): 8-byte header CompSize/OrigSize consistent with SrcSize, then a block whose ReadPTLen tables decode the Char&Len set such that ReadCLen reads Number (9 bits) = large value and repeatedly decodes the code that maps to CharC==2, supplying GetBits(9)=large run lengths so the inner `Sd->mCLen[Index++] = 0;` loop advances Index past 510 and keeps overrunning across many outer iterations, corrupting memory beyond mCLen[510] within/after the SCRATCH_DATA buffer.", "confidence": 0.9}, {"title": "GetInfo reports DstSize purely from attacker-controlled header (size mismatch / undersized output buffer risk)", "file": "uefi_firmware/compression/Tiano/Decompress.c", "line": 717, "cwe": "CWE-130", "vuln_class": "info-disclosure", "severity": "low", "description": "GetInfo() derives *DstSize entirely from the 4-byte OrigSize field in the attacker-controlled source header with no sanity bound vs SrcSize. Decompress() later enforces DstSize==OrigSize, so a mismatch is rejected, but a caller that allocates based on this value and then runs the decoder is exposed to the ReadCLen/Decode write primitives above. Secondary to the primary finding.", "poc": "Header bytes 4..7 set to an arbitrary 32-bit OrigSize control the size returned to the caller for buffer allocation.", "confidence": 0.25}], "transcript": ""} |