TrustZone突破漏洞：Ampere UEFI MM驱动程序中的缓冲区溢出与栈信息泄露

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#define BERT_MM_GUID \
    {0xCB01E6A2, 0xB22C, 0x4955, {0xAB, 0x75, 0xAC, 0x65, 0xEF, 0xFA, 0xE9, 0xD8}}

#define BERT_MM_MIN_SIZE 0xe
#define BERT_MM_MAX_SIZE 0x1000

typedef struct {
  UINT8             function;
  UINT8             unknown_0;
  UINT32            size;
  RETURN_STATUS     status;
  UINT8             data[1];
} BertMmHeader;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

uint8_t *bert_latest;

EFI_STATUS
BertMmHandler(EFI_HANDLE DispatchHandle,void *RegisterContext, void *CommBuffer, uint64_t *CommBufferSize) {
  // ...
  BertMmHeader *header;

  header = (BertMmHeader *)CommBuffer;

  if (CommBuffer == NULL || CommBufferSize == 0x0) {
    return 0;
  }
  if (*CommBufferSize < BERT_MM_MIN_SIZE) { 
    if ((size & 0xff) == 0) {
      return EFI_ACCESS_DENIED;
    }
    __LINE__ = 0x21;
    Debug(DEBUG_ERROR,"%a %d Communication buffer size invalid!\n","BertMmHandler",__LINE__);
    return EFI_ACCESS_DENIED;
  }

  switch(header->function) {
    case 1:
    if (BERT_MM_MAX_SIZE < *CommBufferSize - 0xe) {
      if ((size & 0xff) == 0) {
        return EFI_ACCESS_DENIED;
      }
      __LINE__ = 0x2d;
      goto LAB_000025ac;
    }
    block_size = header->size;
    if (block_size == 0) {
      return EFI_INVALID_PARAMETER;
    }
    else {
      if (mfs == 0x0) {
        GetProtocol();
      }
      payload_data = &header->data;
      if ((*bert_latest >> 1 & 1) == 0) {
        pbVar9 = bert_latest + 8;
        i = 0;
        do {
          if (((bert_latest[i * 0x17] & 1) != 0) &&
             ((bert_latest[i * 0x17] & 4) != 0)) {
            path = pbVar9;
          }
          i = i + 1;
          pbVar9 = pbVar9 + 0x17;
        } while (i != 3);
        result = mfs->open(mfs, &file, path, 1);
        if (result < 0) {
          result = -0x7ffffffffffffff9;
          return result;
        }
        mfs->read(mfs, file, 0, payload_data, &block_size);
        mfs->close(mfs, file);

      // ...
      }
      else {
        block_buffer buffer;
        buffer.unknown_0 = 1;
        buffer.size0 = 0x20;
        buffer.unknown_2 = 1;
        buffer.unknown_3 = 0;
        buffer.size1 = 0x20;

        CopyMem(payload_data, buffer, block_size);
        // ...