Summary

Tcg2MeasureGptTable() reads untrusted input from disk, and an attacker can set up a malicious GPT table that triggers an integer overflow that leads to a buffer overflow. This is due to a lack of validation of the GPT Primary Header.

This vulnerability was originally reported at https://bugzilla.tianocore.org/show_bug.cgi?id=4117.

Details

Tcg2MeasureGptTable() lacks checks for integer overflows when computing NumberOfPartitionEntries * SizeOfPartitionEntry at multiple places in the function. One way of triggering this vulnerability could be to overflow the EventSize computation at line 251 in SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c, which would lead to AllocateZeroPool() returning a much smaller object than expected, thus leading to a heap-buffer overflow when copying the partition entries into the allocated buffer shortly after the allocation takes place.

Impact

An attacker could use this heap-buffer overflow to achieve arbitrary code execution in the DXE phase in a number of ways:

1. Corrupting PREV-NEXT pointers of an object in the heap to setup an unlink() attack. By default all memory is RWX, so this primitive could be very powerful as could allow an attacker to overwrite code from UEFI applications, or pointers from the BootServices table.
2. Using the heap-buffer overflow itself to overwrite UEFI application code.

Mitigation release plan

Patch files are available now via https://bugzilla.tianocore.org/show_bug.cgi?id=4117. Patch will be integrated for the Feb 2024 EDK2 release.