Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
The function PeiUsbGetAllConfiguration parses USB configuration descriptors from a physically connected USB device (EXTERNAL_UNTRUSTED) and uses two fields from the untrusted descriptor as array indices into fixed-size arrays in the page-allocated PEI_USB_DEVICE structure without proper runtime bounds validation.
The DXE-phase function UsbSelectConfig loops (line 412) on the untrusted NumInterfaces field from the USB configuration descriptor and writes a pointer to each newly created USB_INTERFACE into the fixed-size array Device->Interfaces[USB_MAX_INTERFACE] (16 entries, UsbBus.h:45,178) at line 431.
The GET_OPTION_BUFFER_LEN macro is defined as (Pkt)->Length - sizeof(EFI_DHCP4_HEADER) - 4, where sizeof(EFI_DHCP4_HEADER) is 236 bytes and the additional 4 bytes account for the DHCP magic cookie (total 240).
The GET_OPTION_BUFFER_LEN macro in HttpBootDhcp4.h:166 is identical to the PXE variant: (Pkt)->Length - sizeof(EFI_DHCP4_HEADER) - 4.
The local stack array Blank[PXEBC_DISPLAY_MAX_LINE] (70 bytes, line 279) is indexed at line 349 (Blank[MenuArray[Select]->DescLen] = 0;) and line 426 (Blank[MenuArray[LastSelect]->DescLen] = 0;) using the raw DescLen field sourced from the DHCP4 vendor option BOOT_MENU sub-option (option 43, tag 9).
IScsiBuildKeyValueList receives an attacker-controlled iSCSI Login Response data segment (Data/Len) and, after locating the '=' delimiter for each key, calls AsciiStrLen(KeyValuePair->Value) at line 1925 to measure the value string length with no upper bound derived from the remaining Len.
PeCoffLoaderImageAddress performs only an upper-bound check (Address >= ImageSize + TeStrippedOffset, line 917) before computing the returned pointer as ImageAddress + Address - TeStrippedOffset (line 922).
Dhcp6ParseAddrOption iterates over IA_ADDR sub-options within an IA option's inner data using a loop guarded only by Cursor < IaInnerOpt + IaInnerLen (line 1283).
PxeBcParseDhcp6Options iterates over DHCP6 options using a loop guarded only by Offset < Length (line 50).
HttpBootParseDhcp6Options iterates over DHCP6 options using a loop guarded only by Offset < Length (line 149).
The function reads a host-controlled file-directory count from QEMU fw_cfg via QemuFwCfgRead32() and uses it to size an AllocatePool call without checking the return value for NULL.
Ip6IsOptionValid iterates over TLV-encoded options in IPv6 Hop-by-Hop and Destination Options extension headers using a loop guarded only by while (Offset < OptionLen).
This is a variant of Finding 2.
The bounds check at line 425 compares Dst->Size (total buffer allocation = 1480 bytes) against Src->Length (network-controlled, data-only length).
Identical pattern to the DHCP4 variant.
In the PE/COFF section loading loop at line 1404, the End bounds check computes Section->VirtualAddress + Section->Misc.VirtualSize - 1 where both operands are UINT32.
ParseDnsResponse dispatches on the attacker-controlled DNS answer section Type field (AnswerSection->Type, byte-swapped from raw wire bytes at line 1416) via a switch statement at line 1496, selecting between incompatible DNS4_TOKEN_ENTRY (for DNS_TYPE_A) and DNS6_TOKEN_ENTRY (for DNS_TYPE_AAAA) struct interpretations.
Identical bug to Ip4TrimPacket.
ReadDirectoryEntry loops over a directory's recorded data, advancing a byte cursor (FidOffset) and casting it to a UDF_FILE_IDENTIFIER_DESCRIPTOR pointer via GET_FID_FROM_ADS (a raw (UINT8*)Data + offset cast).
GetLongAdFromAds loops over a file entry's allocation descriptor sequence, advancing a byte cursor (*Offset) and casting it to a UDF_LONG_ALLOCATION_DESCRIPTOR pointer.
GetShortAdFromAds loops over a file entry's allocation descriptor sequence, advancing a byte cursor (*Offset) and casting it to a UDF_SHORT_ALLOCATION_DESCRIPTOR pointer.
Ip6IsExtsValid iterates over the IPv6 extension-header chain using a loop guarded only by while (Offset <= ExtHdrsLen).
PxeBcExtractDiscoverInfo iterates over variable-length PXEBC_BOOT_SVR_ENTRY structures from the DHCP4 vendor option 43 boot-servers sub-option using a loop guarded only by (UINT8)(Entry - VendorOpt->BootSvr) < VendorOpt->BootSvrLen.
UsbEthNcmReceive parses an attacker-supplied NCM16 Network Transfer Buffer (NTH16 + NDP16 + datagrams) received via USB bulk transfer from a USB CDC-NCM Ethernet adapter.
RndisUndiReceive is the RNDIS implementation of the same EDKII_USB_ETHERNET_PROTOCOL.UsbEthReceive handler interface.
// No embargoed advisories.