diff mbox series

arm/edk2-firmware: fix ICMP error handling vulnerabilities

Message ID 20261102150708.9686-1-jon.mason@arm.com
State New
Headers show
Series arm/edk2-firmware: fix ICMP error handling vulnerabilities | expand

Commit Message

Jon Mason Nov. 2, 2026, 3:07 p.m. UTC 
Backport two upstream EDK2 fixes to address security issues in the
IPv4 and IPv6 ICMP error handlers.

CVE-2026-97631 fixes incorrect buffer copy logic that could allow
oversized ICMP error packets to write beyond the allocated buffer,
potentially causing memory corruption. Add proper boundary checks
and correct buffer offset calculations to safely truncate packets
that exceed the available buffer space.

The second fix initializes the ICMP error buffer before copying
received fragments, preventing short packets from leaving stale
data from previous errors in the buffer.

These fixes have been merged upstream as commits
560ed9b5b146ed622d7eb7c40254a9099bd65b84 and
fa789071ff0b29f1e568bfe153ef7f3d76bd60e4.

Signed-off-by: Jon Mason <jon.mason@arm.com>
---
 ...-fix-SmbiosType2Genertor-build-failu.patch |   5 +-
 ...xeBcDxe-Fix-ICMP-buffer-overflow-in-.patch | 127 ++++++++++++++++++
 ...xeBcDxe-Clear-ICMP-error-buffer-befo.patch |  38 ++++++
 .../recipes-bsp/uefi/edk2-firmware_202608.bb  |   6 +-
 4 files changed, 171 insertions(+), 5 deletions(-)
 create mode 100644 meta-arm/recipes-bsp/uefi/edk2-firmware/0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch
 create mode 100644 meta-arm/recipes-bsp/uefi/edk2-firmware/0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch
diff mbox series

Patch

diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch b/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch
index 0352beac6565..c2f1a3aca014 100644
--- a/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware/0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch
@@ -1,4 +1,4 @@ 
-From 7d2f6b6e31fad2c96c6fc55c17e79f8c96b4bfcf Mon Sep 17 00:00:00 2001
+From 0debd3a1f4b5abf0c75c26ec1e85d9fa33510c89 Mon Sep 17 00:00:00 2001
 From: Yeoreum Yun <yeoreum.yun@arm.com>
 Date: Mon, 10 Aug 2026 15:40:06 +0100
 Subject: [PATCH] DynamicTablesPkg: fix SmbiosType2Genertor build failure with
@@ -36,6 +36,3 @@  index 1250ef8059e9..5345d2b6d233 100644
    {
      DEBUG ((DEBUG_ERROR, "%a: Invalid Baseboard object list\n", __func__));
      return EFI_INVALID_PARAMETER;
--- 
-2.39.5
-
diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware/0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch b/meta-arm/recipes-bsp/uefi/edk2-firmware/0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch
new file mode 100644
index 000000000000..54c1da7b0c34
--- /dev/null
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware/0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch
@@ -0,0 +1,127 @@ 
+From 1c89a7982247eb994956140caf794f4f40e85de9 Mon Sep 17 00:00:00 2001
+From: santhoshkumarv <santhoshkumarv@ami.com>
+Date: Mon, 28 Sep 2026 06:06:24 -0700
+Subject: [PATCH] NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in
+ IPv4/IPv6 handlers (CVE-2026-97631)
+
+Root Cause:
+Incorrect buffer copy logic in ICMP error handling allowed large packets
+to write beyond the allocated buffer. This could overwrite adjacent memory
+with attacker-controlled data, causing memory corruption.
+
+Resolution:
+Added proper boundary checks and corrected buffer offset calculations
+in IPv4 and IPv6 ICMP error handlers. Over sized ICMP error packets are now
+safely truncated when the buffer is full, preventing memory corruption.
+
+Signed-off-by: santhoshkumarV <santhoshkumarv@ami.com>
+
+Upstream-Status: Backport [560ed9b5b146ed622d7eb7c40254a9099bd65b84]
+CVE: CVE-2026-97631
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+---
+ NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c | 68 ++++++++++----------------
+ 1 file changed, 26 insertions(+), 42 deletions(-)
+
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+index 887ea3e7d7d8..9e97ba4904c7 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
++++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+@@ -252,6 +252,7 @@ PxeBcIcmpErrorDpcHandle (
+   UINTN                   Index;
+   UINT32                  CopiedLen;
+   UINT8                   *IcmpError;
++  UINT32                  FragmentLen;
+ 
+   Private = (PXEBC_PRIVATE_DATA *)Context;
+   Mode    = &Private->Mode;
+@@ -317,28 +318,19 @@ PxeBcIcmpErrorDpcHandle (
+   }
+ 
+   //
+-  // Copy the right ICMP error message into mode data.
++  // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
++  // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
+-  CopiedLen = 0;
+-  IcmpError = (UINT8 *)&Mode->IcmpError;
+-
+-  for (Index = 0; Index < RxData->FragmentCount; Index++) {
+-    CopiedLen += RxData->FragmentTable[Index].FragmentLength;
+-    if (CopiedLen <= sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)) {
+-      CopyMem (
+-        IcmpError,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        RxData->FragmentTable[Index].FragmentLength
+-        );
+-    } else {
+-      CopyMem (
+-        IcmpError,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        CopiedLen - sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)
+-        );
+-    }
+-
+-    IcmpError += CopiedLen;
++  for (Index = 0, IcmpError = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
++       (Index < RxData->FragmentCount) &&
++       (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
++       Index++, IcmpError += FragmentLen, CopiedLen += FragmentLen)
++  {
++    FragmentLen = MIN (
++                    RxData->FragmentTable[Index].FragmentLength,
++                    (UINT32)(sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR) - CopiedLen)
++                    );
++    CopyMem (IcmpError, RxData->FragmentTable[Index].FragmentBuffer, FragmentLen);
+   }
+ 
+ ON_RECYCLE:
+@@ -387,6 +379,7 @@ PxeBcIcmp6ErrorDpcHandle (
+   UINT8                   Type;
+   UINT32                  CopiedLen;
+   UINT8                   *Icmp6Error;
++  UINT32                  FragmentLen;
+ 
+   Private = (PXEBC_PRIVATE_DATA *)Context;
+   Mode    = &Private->Mode;
+@@ -449,28 +442,19 @@ PxeBcIcmp6ErrorDpcHandle (
+   }
+ 
+   //
+-  // Copy the right ICMP6 error message into mode data.
++  // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
++  // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
+-  CopiedLen  = 0;
+-  Icmp6Error = (UINT8 *)&Mode->IcmpError;
+-
+-  for (Index = 0; Index < RxData->FragmentCount; Index++) {
+-    CopiedLen += RxData->FragmentTable[Index].FragmentLength;
+-    if (CopiedLen <= sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)) {
+-      CopyMem (
+-        Icmp6Error,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        RxData->FragmentTable[Index].FragmentLength
+-        );
+-    } else {
+-      CopyMem (
+-        Icmp6Error,
+-        RxData->FragmentTable[Index].FragmentBuffer,
+-        CopiedLen - sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR)
+-        );
+-    }
+-
+-    Icmp6Error += CopiedLen;
++  for (Index = 0, Icmp6Error = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
++       (Index < RxData->FragmentCount) &&
++       (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
++       Index++, Icmp6Error += FragmentLen, CopiedLen += FragmentLen)
++  {
++    FragmentLen = MIN (
++                    RxData->FragmentTable[Index].FragmentLength,
++                    (UINT32)(sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR) - CopiedLen)
++                    );
++    CopyMem (Icmp6Error, RxData->FragmentTable[Index].FragmentBuffer, FragmentLen);
+   }
+ 
+ ON_RECYCLE:
diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware/0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch b/meta-arm/recipes-bsp/uefi/edk2-firmware/0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch
new file mode 100644
index 000000000000..f0d07bc59719
--- /dev/null
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware/0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch
@@ -0,0 +1,38 @@ 
+From bff45da697fecf64927fbc38eacfcf41f20b763b Mon Sep 17 00:00:00 2001
+From: Michael D Kinney <michael.d.kinney@intel.com>
+Date: Wed, 14 Oct 2026 12:34:35 -0700
+Subject: [PATCH] NetworkPkg/UefiPxeBcDxe: Clear ICMP error buffer before
+ copying
+
+Zero the ICMP error buffer before copying fragments so short packets do not
+leave stale bytes from a previous error.
+
+Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
+
+Upstream-Status: Backport [fa789071ff0b29f1e568bfe153ef7f3d76bd60e4]
+CVE: CVE-2026-97631
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+---
+ NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+index 9e97ba4904c7..7795e4f187d2 100644
+--- a/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
++++ b/NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
+@@ -321,6 +321,7 @@ PxeBcIcmpErrorDpcHandle (
+   // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
+   // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
++  ZeroMem (&Mode->IcmpError, sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
+   for (Index = 0, IcmpError = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
+        (Index < RxData->FragmentCount) &&
+        (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
+@@ -445,6 +446,7 @@ PxeBcIcmp6ErrorDpcHandle (
+   // Copy ICMP error fragments into Mode->IcmpError in order. The maximum
+   // buffer size is sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR); truncate any excess.
+   //
++  ZeroMem (&Mode->IcmpError, sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
+   for (Index = 0, Icmp6Error = (UINT8 *)&Mode->IcmpError, CopiedLen = 0;
+        (Index < RxData->FragmentCount) &&
+        (CopiedLen < sizeof (EFI_PXE_BASE_CODE_ICMP_ERROR));
diff --git a/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb b/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb
index 5008fcca467b..5411e7b186ec 100644
--- a/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb
+++ b/meta-arm/recipes-bsp/uefi/edk2-firmware_202608.bb
@@ -4,4 +4,8 @@  SRCREV_edk2           ?= "2970e5699ba6267f3384ffab20f96647578aebc8"
 SRCREV_edk2-platforms ?= "c98cdf8de9bd84a3267623e64f4388e21de69512"
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
-SRC_URI += "file://0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch"
+SRC_URI += " \
+        file://0001-DynamicTablesPkg-fix-SmbiosType2Genertor-build-failu.patch \
+        file://0002-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch \
+        file://0003-NetworkPkg-UefiPxeBcDxe-Clear-ICMP-error-buffer-befo.patch \
+       "