dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-12 22:17:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

boot: bound PE section VirtualSize before zeroing the inner kernel

Browse Source 
The inner-kernel section loader checks VirtualAddress + SizeOfRawData
against kernel_size_in_memory (for the memcpy), but the memzero right
after it clears up to VirtualAddress + VirtualSize, and VirtualSize is
only constrained to be >= SizeOfRawData.

Reject a VirtualAddress + VirtualSize that overflows or exceeds
kernel_size_in_memory, mirroring the existing SizeOfRawData checks.

Follow-up for cab9c7b5a4

(cherry picked from commit feeba8fa3b)
(cherry picked from commit 0f3dd7ab02)
(cherry picked from commit 2889746af2)
This commit is contained in:
Luca Boccassi
2026-06-26 20:12:36 +01:00
parent 5a569c49b2
commit 42e5b6d004
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/boot/linux.c
View File

@@ -289,6 +289,10 @@ EFI_STATUS linux_exec(
return log_error_status(EFI_LOAD_ERROR, "Section would write outside of memory");
if (h->SizeOfRawData > h->VirtualSize)
return log_error_status(EFI_LOAD_ERROR, "Invalid PE section, raw data size is greater than virtual size");
if (UINT32_MAX - h->VirtualAddress < h->VirtualSize)
return log_error_status(EFI_LOAD_ERROR, "Invalid PE section, VirtualSize + VirtualAddress overflows");
if (h->VirtualAddress + h->VirtualSize > kernel_size_in_memory)
return log_error_status(EFI_LOAD_ERROR, "Section virtual size would write outside of memory");
if (UINT32_MAX - h->PointerToRawData < h->SizeOfRawData)
return log_error_status(EFI_LOAD_ERROR, "Invalid PE section, PointerToRawData + SizeOfRawData overflows");
if (h->PointerToRawData + h->SizeOfRawData > kernel->iov_len)