Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
The function PeiUsbGetAllConfiguration parses USB configuration descriptors from a physically connected USB device (EXTERNAL_UNTRUSTED) and uses two fields from the untrusted descriptor as array indices into fixed-size arrays in the page-allocated PEI_USB_DEVICE structure without proper runtime bounds validation.
The DXE-phase function UsbSelectConfig loops (line 412) on the untrusted NumInterfaces field from the USB configuration descriptor and writes a pointer to each newly created USB_INTERFACE into the fixed-size array Device->Interfaces[USB_MAX_INTERFACE] (16 entries, UsbBus.h:45,178) at line 431.
The GET_OPTION_BUFFER_LEN macro is defined as (Pkt)->Length - sizeof(EFI_DHCP4_HEADER) - 4, where sizeof(EFI_DHCP4_HEADER) is 236 bytes and the additional 4 bytes account for the DHCP magic cookie (total 240).
The GET_OPTION_BUFFER_LEN macro in HttpBootDhcp4.h:166 is identical to the PXE variant: (Pkt)->Length - sizeof(EFI_DHCP4_HEADER) - 4.
The local stack array Blank[PXEBC_DISPLAY_MAX_LINE] (70 bytes, line 279) is indexed at line 349 (Blank[MenuArray[Select]->DescLen] = 0;) and line 426 (Blank[MenuArray[LastSelect]->DescLen] = 0;) using the raw DescLen field sourced from the DHCP4 vendor option BOOT_MENU sub-option (option 43, tag 9).
IScsiBuildKeyValueList receives an attacker-controlled iSCSI Login Response data segment (Data/Len) and, after locating the '=' delimiter for each key, calls AsciiStrLen(KeyValuePair->Value) at line 1925 to measure the value string length with no upper bound derived from the remaining Len.
PeCoffLoaderImageAddress performs only an upper-bound check (Address >= ImageSize + TeStrippedOffset, line 917) before computing the returned pointer as ImageAddress + Address - TeStrippedOffset (line 922).
Dhcp6ParseAddrOption iterates over IA_ADDR sub-options within an IA option's inner data using a loop guarded only by Cursor < IaInnerOpt + IaInnerLen (line 1283).
PxeBcParseDhcp6Options iterates over DHCP6 options using a loop guarded only by Offset < Length (line 50).
HttpBootParseDhcp6Options iterates over DHCP6 options using a loop guarded only by Offset < Length (line 149).
The function reads a host-controlled file-directory count from QEMU fw_cfg via QemuFwCfgRead32() and uses it to size an AllocatePool call without checking the return value for NULL.
Ip6IsOptionValid iterates over TLV-encoded options in IPv6 Hop-by-Hop and Destination Options extension headers using a loop guarded only by while (Offset < OptionLen).
This is a variant of Finding 2.
The bounds check at line 425 compares Dst->Size (total buffer allocation = 1480 bytes) against Src->Length (network-controlled, data-only length).
Identical pattern to the DHCP4 variant.
In the PE/COFF section loading loop at line 1404, the End bounds check computes Section->VirtualAddress + Section->Misc.VirtualSize - 1 where both operands are UINT32.
ParseDnsResponse dispatches on the attacker-controlled DNS answer section Type field (AnswerSection->Type, byte-swapped from raw wire bytes at line 1416) via a switch statement at line 1496, selecting between incompatible DNS4_TOKEN_ENTRY (for DNS_TYPE_A) and DNS6_TOKEN_ENTRY (for DNS_TYPE_AAAA) struct interpretations.
Identical bug to Ip4TrimPacket.
ReadDirectoryEntry loops over a directory's recorded data, advancing a byte cursor (FidOffset) and casting it to a UDF_FILE_IDENTIFIER_DESCRIPTOR pointer via GET_FID_FROM_ADS (a raw (UINT8*)Data + offset cast).
GetLongAdFromAds loops over a file entry's allocation descriptor sequence, advancing a byte cursor (*Offset) and casting it to a UDF_LONG_ALLOCATION_DESCRIPTOR pointer.
GetShortAdFromAds loops over a file entry's allocation descriptor sequence, advancing a byte cursor (*Offset) and casting it to a UDF_SHORT_ALLOCATION_DESCRIPTOR pointer.
Ip6IsExtsValid iterates over the IPv6 extension-header chain using a loop guarded only by while (Offset <= ExtHdrsLen).
PxeBcExtractDiscoverInfo iterates over variable-length PXEBC_BOOT_SVR_ENTRY structures from the DHCP4 vendor option 43 boot-servers sub-option using a loop guarded only by (UINT8)(Entry - VendorOpt->BootSvr) < VendorOpt->BootSvrLen.
UsbEthNcmReceive parses an attacker-supplied NCM16 Network Transfer Buffer (NTH16 + NDP16 + datagrams) received via USB bulk transfer from a USB CDC-NCM Ethernet adapter.
RndisUndiReceive is the RNDIS implementation of the same EDKII_USB_ETHERNET_PROTOCOL.UsbEthReceive handler interface.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.
Technical details are withheld during coordinated disclosure.