MdeModulePkg/RamDiskDxe: Restrict on RAM disk size (CVE-2018-12180)

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1134

Originally, the block size of created Ram disks is hard-coded to 512
bytes. However, if the total size of the Ram disk is not a multiple of 512
bytes, there will be potential memory access issues when dealing with the
last block of the Ram disk.

This commit will adjust the block size of the Ram disks to ensure that the
total size is a multiple of the block size.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Ray Ni <ray.ni@intel.com>

diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
index 4f74b5ef1531aa80cead18f867e1744dd98ab176..8926ad7d2f5a347465255e88b6b6cc10761b3587 100644 (file)
--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
+++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskBlockIo.c
@@ -1,7 +1,7 @@
 /** @file\r
   Produce EFI_BLOCK_IO_PROTOCOL on a RAM disk device.\r
 \r
 /** @file\r
   Produce EFI_BLOCK_IO_PROTOCOL on a RAM disk device.\r
 \r

-  Copyright (c) 2016 - 2018, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>\r

   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r


@@ -54,6 +54,7 @@ RamDiskInitBlockIo (
   EFI_BLOCK_IO_PROTOCOL           *BlockIo;\r
   EFI_BLOCK_IO2_PROTOCOL          *BlockIo2;\r
   EFI_BLOCK_IO_MEDIA              *Media;\r
   EFI_BLOCK_IO_PROTOCOL           *BlockIo;\r
   EFI_BLOCK_IO2_PROTOCOL          *BlockIo2;\r
   EFI_BLOCK_IO_MEDIA              *Media;\r

+  UINT32                          Remainder;\r

 \r
   BlockIo  = &PrivateData->BlockIo;\r
   BlockIo2 = &PrivateData->BlockIo2;\r
 \r
   BlockIo  = &PrivateData->BlockIo;\r
   BlockIo2 = &PrivateData->BlockIo2;\r


@@ -69,11 +70,18 @@ RamDiskInitBlockIo (
   Media->LogicalPartition = FALSE;\r
   Media->ReadOnly         = FALSE;\r
   Media->WriteCaching     = FALSE;\r
   Media->LogicalPartition = FALSE;\r
   Media->ReadOnly         = FALSE;\r
   Media->WriteCaching     = FALSE;\r

-  Media->BlockSize        = RAM_DISK_BLOCK_SIZE;\r
-  Media->LastBlock        = DivU64x32 (\r
-                              PrivateData->Size + RAM_DISK_BLOCK_SIZE - 1,\r
-                              RAM_DISK_BLOCK_SIZE\r
-                              ) - 1;\r
+\r
+  for (Media->BlockSize = RAM_DISK_DEFAULT_BLOCK_SIZE;\r
+       Media->BlockSize >= 1;\r
+       Media->BlockSize = Media->BlockSize >> 1) {\r
+    Media->LastBlock = DivU64x32Remainder (PrivateData->Size, Media->BlockSize, &Remainder) - 1;\r
+    if (Remainder == 0) {\r
+      break;\r
+    }\r
+  }\r
+  ASSERT (Media->BlockSize != 0);\r
+\r
+  return;\r

 }\r
 \r
 \r
 }\r
 \r
 \r

diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h
index 08a8ca94c9db68ee5680e6988a58c20d850b4918..72f2bfe17932603e25b7e730e2358443bb62c03c 100644 (file)
--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h
+++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskImpl.h
@@ -1,7 +1,7 @@
 /** @file\r
   The header file of RamDiskDxe driver.\r
 \r
 /** @file\r
   The header file of RamDiskDxe driver.\r
 \r

-  Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>\r

   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   which accompanies this distribution.  The full text of the license may be found at\r


@@ -49,9 +49,9 @@
 ///\r
 \r
 //\r
 ///\r
 \r
 //\r

-// Block size for RAM disk\r
+// Default block size for RAM disk\r

 //\r
 //\r

-#define RAM_DISK_BLOCK_SIZE 512\r
+#define RAM_DISK_DEFAULT_BLOCK_SIZE 512\r

 \r
 //\r
 // Iterate through the double linked list. NOT delete safe\r
 \r
 //\r
 // Iterate through the double linked list. NOT delete safe\r

diff --git a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c
index 6784e2b2f1e9c89a44ba6d71be9400e42897988a..e8250d5c1bcc6e68a30f6b5fba935cb03c11fef0 100644 (file)
--- a/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c
+++ b/MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskProtocol.c
@@ -1,7 +1,7 @@
 /** @file\r
   The realization of EFI_RAM_DISK_PROTOCOL.\r
 \r
 /** @file\r
   The realization of EFI_RAM_DISK_PROTOCOL.\r
 \r

-  Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+  Copyright (c) 2016 - 2019, Intel Corporation. All rights reserved.<BR>\r

   (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r
   (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>\r
   This program and the accompanying materials\r
   are licensed and made available under the terms and conditions of the BSD License\r


@@ -613,7 +613,8 @@ RamDiskRegister (
   //\r
   // Add check to prevent data read across the memory boundary\r
   //\r
   //\r
   // Add check to prevent data read across the memory boundary\r
   //\r

-  if (RamDiskBase + RamDiskSize > ((UINTN) -1) - RAM_DISK_BLOCK_SIZE + 1) {\r
+  if ((RamDiskSize > MAX_UINTN) ||\r
+      (RamDiskBase > MAX_UINTN - RamDiskSize + 1)) {\r

     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r