Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
The function reads a host-controlled file-directory count from QEMU fw_cfg via QemuFwCfgRead32() and uses it to size an AllocatePool call without checking the return value for NULL.
In XhcInitSched, three allocations use ASSERT-only guards before dereference.
The 64-bit counterpart of XhcInitializeDeviceSlot.
In XhcInitializeEndpointContext, two EndpointTransferRing allocations have NO NULL CHECK AT ALL (not even ASSERT) before the result is stored and passed to CreateTransferRing which dereferences it.
The 64-byte-context counterpart of XhcInitializeEndpointContext, used when the controller reports Csz != 0 (Xhci.c:1110-1113).
An additional unchecked allocation within XhcInitializeDeviceSlot, next to the unchecked InputContext (line 2246) and EndpointTransferRing (line 2307) allocations in the same function.
In the GET_DESCRIPTOR hook of the XHCI DXE control transfer handler XhcControlTransfer (Xhci.c:1035-1075), three AllocateZeroPool calls have NO NULL CHECK before dereference.
The PEI-phase counterpart of CreateTransferRing.
The PEI-phase counterpart of CreateEventRing.
The PEI-phase counterpart of XhcInitSched.
The PEI-phase counterpart of XhcInitializeDeviceSlot.
The PEI-phase 64-bit counterpart of XhcInitializeDeviceSlot.
The PEI-phase counterpart of XhcInitializeEndpointContext.
The PEI-phase 64-bit counterpart of XhcInitializeEndpointContext64.
In FvIsBeingProcessed, a KNOWN_HANDLE is allocated with AllocatePool(sizeof(KNOWN_HANDLE)) but only guarded by ASSERT(KnownHandle != NULL) — a no-op in RELEASE builds.
In the XenStore string-list parsing helper Split, Dst = AllocatePool(*NumPtr * sizeof(CHAR8 *) + Len) has NO NULL CHECK before CopyMem at line 233 writes through it via &Dst[*NumPtr].
In XenStoreJoin, Buf = AllocatePool(BufSize) is guarded only by ASSERT(Buf != NULL) — a no-op in RELEASE builds.
In XenStoreVSPrint, Buf = AllocateZeroPool(BufSize) has NO NULL CHECK before it is passed to AsciiVSPrint(Buf, BufSize, FormatString, Marker) at line 1383 and to XenStoreWrite at line 1384.
In the XenBusDxe driver binding Start function (XenBusDxeDriverBindingStart, line 312), Dev = AllocateZeroPool(sizeof(*Dev)) has NO NULL CHECK before Dev->Signature = XENBUS_DEVICE_SIGNATURE at line 350 dereferences it.
In XenStoreProcessMessage, a XENSTORE_MESSAGE is allocated with AllocateZeroPool(sizeof(XENSTORE_MESSAGE)) without checking for NULL.
In XenStoreRegisterWatch, a XENSTORE_WATCH is allocated with AllocateZeroPool(sizeof(XENSTORE_WATCH)) without checking for NULL.
In CreateTransferRing, UsbHcAllocateMem (which returns NULL on failure) is called, but only an ASSERT(Buf != NULL) guards the result.
Multiple unchecked allocations lead to NULL pointer dereference in RELEASE builds during USB device slot initialization.
The SMM driver dispatcher allocates an EFI_SMM_DRIVER_ENTRY with AllocateZeroPool but only guards it with ASSERT(DriverEntry != NULL), which compiles to a no-op in RELEASE.
In UpdateVariableInfo, a VARIABLE_INFO_ENTRY is allocated with AllocateZeroPool guarded only by ASSERT — a no-op in RELEASE.
// No embargoed advisories.