Skip to content

Integer Overflow in CreateHob() could lead to HOB OOB R/W

High
jkmathews published GHSA-ch4w-v7m3-g8wx Jan 9, 2024

Package

UefiPayloadPkg (EDK2)

Affected versions

<=202311

Patched versions

None

Description

Summary

An integer overflow can be triggered in CreateHob() when aligning the requested size.

This vulnerability was originally reported at https://bugzilla.tianocore.org/show_bug.cgi?id=4166.

Details

The CreateHob() function aligns the requested size to 8 performing the following operation:

HobLength = (UINT16)((HobLength + 0x7) & (~0x7));

No checks are performed to ensure this value doesn't overflow, and could lead to CreateHob() returning a smaller HOB than requested, which could lead to OOB HOB accesses.

Impact

Exploitability here seems tricky, as an attacker would need to trigger this vulnerability in the PEI phase. On the other hand, the number of calls to this function is fairly high.

Mitigation release plan

Patch files are available now via https://bugzilla.tianocore.org/show_bug.cgi?id=4166. Patch will be integrated for the Feb 2024 EDK2 release.

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

CVE ID

CVE-2022-36765

Weaknesses

Credits