Security Advisory
Search…
Security Advisory
1.0.0
Security Advisory
1. Insecure Default Secure Boot Policy for Option ROMs
2. Incorrect PKCS#1v1.5 Padding Verification for RSA Signature Check
3. UEFI Variable “Reinstallation”
4. Overwrite from Performance Data Variable
5. CommBuffer SMM Overwrite/Exposure
6. TOCTOU Issue with CommBuffer
7. SMRAM Overwrite in Fault Tolerant Write SMI Handler
8. SMRAM Overwrite in SmmVariableHandler
9. Integer/Heap Overflow in SetVariable
10. Heap Overflow in UpdateVariable
11. Overwrite from FirmwarePerformance Variable
12. Integer/Buffer Overflow in TpmDxe Driver
13. Protection of PhysicalPresence Variable
14. Boot Failure Related to UEFI Variable Usage
15. Buffer Overflows in Capsule Update
16. Boot Failure Related to TPM Measurements
17. Buffer Overflow in Variable Reclaim
18. Overflow in Processing of AuthVarKeyDatabase
19. Counter Based Authenticated Variable Issue
20. Honoring Memory Only Reset Control and correct MOR spec imlementation
21. TCG PP S4 issue
22. BIOS Password
23. OPAL driver has PP issue on BlockSid
24. OPAL driver has PSID issue
25. DHCP misses boundary check for network packet
26. SmmCore comm buffer check has TOCTOU issue
27. UEFI Variable Deletion/Corruption
28. EDK II Untested memory not covered by SMM page protection
29. Unauthenticated Firmware Chain-of-Trust Bypass
30. EDK II Authenticated Variable Bypass
31. EDK II TianoCompress Bounds Checking Issues
32. DNS Packet Size Check
33. Opal BlockSid Setting Disabled after S3
34. PartitionDxe and Udf Buffer Overflow
35. Stack Overflow on Corrupted BMP
36. Buffer Overflow in BlockIo service for RAM disk
37. XHCI stack local stack overflow
38. SW SMI Confused Deputy SmramSaveState.c
39. Unlimited FV Recursion
40. AuthVariable Timestamp Zeroing on APPEND_WRITE
41. BootGuard TOCTOU
Powered By GitBook
26. SmmCore comm buffer check has TOCTOU issue

Description:

A SMM communication buffer is used for data exchange between the SMM component and the non-SMM component. The malicious non-SMM component may generate a malicious SMM communication buffer to attack the SMM component. In order to resist this attack, the SMM component need validate the SMM communication buffer before use it. The validation need cover if the SMM communication buffer overlaps with the SMRAM. The data to be validated should be copied into SMRAM as local variable to avoid Time-Of-Check/Time-Of-Use attack. If the data is not copied into SMRAM, the validation can be bypassed.
For example, a malicious software may let an Application Processor (AP) be outside SMRAM, and only let a Bootstrap Processor (BSP) be inside SMRAM. After the BSP performs the check for the communication buffer, the AP modified the communication buffer. Then when the BSP uses the communication buffer later, the BSP is attacked and the check is actually bypassed.
See MdeModulePkg/Core/PiSmmCore/PiSmmCore.c: The function InternalIsBufferOverlapped and SmmIsBufferOutsideSmmValid are the checker. They validate gSmmCorePrivate->CommunicationBuffer and gSmmCorePrivate->BufferSize
However these data are outside SMRAM, the malicious code may modify them after check. So below code may still get wrong gSmmCorePrivate->CommunicationBuffer.

Recommendation:

We need copy gSmmCorePrivate->CommunicationBuffer and gSmmCorePrivate->BufferSize to be a local variable, then check and use them, finally sync local variable back to outside SMRAM.
Because the BufferSize is moved to SMRAM by SmmCore, the SMM driver should not check the address for the BufferSize.
This is addressed by EDK2 GIT eaae7b33b1cf6b9f21db1636f219c2b6a8d88afd, 62016c1e898434a0326f658912b1e7e0a9c5575e.

Acknowledgments:

Reported by Yao, Jiewen [email protected]​

References:

• USRT M1636
Previous
25. DHCP misses boundary check for network packet
Next
27. UEFI Variable Deletion/Corruption
Last modified 2yr ago
Copy link
On this page
Description:
Recommendation:
Acknowledgments:
References: