efi-boot-shim.git, branch 15.8

Bump version to 15.8

2024-01-22T19:18:05+00:00

What's changed * Various CVE fixes: CVE-2023-40546 mok: fix LogError() invocation CVE-2023-40547 - avoid incorrectly trusting HTTP headers CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system CVE-2023-40549 Authenticode: verify that the signature header is in bounds. CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat() CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries * Add make infrastructure to set the NX_COMPAT flag by @vathpela in https://github.com/rhboot/shim/pull/530 * Make sbat_var.S parse right with buggy gcc/binutils by @vathpela in https://github.com/rhboot/shim/pull/535 * Drop invalid calls to CRYPTO_set_mem_functions by @nicholasbishop in https://github.com/rhboot/shim/pull/537 * pe: Align section size up to page size for mem attrs by @nicholasbishop in https://github.com/rhboot/shim/pull/539 * test-sbat: Fix exit code by @vathpela in https://github.com/rhboot/shim/pull/540 * pe: Add IS_PAGE_ALIGNED macro by @nicholasbishop in https://github.com/rhboot/shim/pull/541 * CryptoPkg/BaseCryptLib: Fix buffer overflow issue in realloc wrapper by @nicholasbishop in https://github.com/rhboot/shim/pull/546 * Don't loop forever in load_certs() with buggy firmware by @rmetrich in https://github.com/rhboot/shim/pull/547 * Block Debian grub binaries with SBAT < 4 by @steve-mcintyre in https://github.com/rhboot/shim/pull/550 * Shim unable to locate grubx64 in PXE boot mode when grubx64 is stored in a different file path by @Alberto-Perez-Guevara in https://github.com/rhboot/shim/pull/551 * Further improve load_certs() for non-compliant drivers/firmwares by @pbatard in https://github.com/rhboot/shim/pull/560 * pe: only process RelocDir->Size of reloc section by @mikebeaton in https://github.com/rhboot/shim/pull/562 * Rename 'msecs' to 'usecs' to avoid potential confusion by @aronowski in https://github.com/rhboot/shim/pull/563 * Optionally allow to keep shim protocol installed by @bluca in https://github.com/rhboot/shim/pull/565 * SBAT-related documents formatting and spelling by @aronowski in https://github.com/rhboot/shim/pull/566 * Add SbatLevel_Variable.txt to document the various revocations by @jsetje in https://github.com/rhboot/shim/pull/569 * Add a security contact email address in README.md by @vathpela in https://github.com/rhboot/shim/pull/572 * Use -Wno-unused-but-set-variable for Cryptlib and OpenSSL by @vathpela in https://github.com/rhboot/shim/pull/576 * mok: fix LogError() invocation by @vathpela in https://github.com/rhboot/shim/pull/577 * Minor housekeeping by @vathpela in https://github.com/rhboot/shim/pull/578 * Test ImageAddress() by @vathpela in https://github.com/rhboot/shim/pull/579 * FreePages() is used to return memory allocated by AllocatePages() by @dennis-tseng99 in https://github.com/rhboot/shim/pull/580 * Size should minus 1 when calculating 'RelocBaseEnd' by @jsetje in https://github.com/rhboot/shim/pull/581 * Verify signature before verifying sbat levels by @jsetje in https://github.com/rhboot/shim/pull/583 * Add libFuzzer support for csv.c and sbat.c by @vathpela in https://github.com/rhboot/shim/pull/584 * mok: Avoid underflow in maximum variable size calculation by @alpernebbi in https://github.com/rhboot/shim/pull/587 * Housekeeping by @vathpela in https://github.com/rhboot/shim/pull/605 Signed-off-by: Peter Jones

gitmodules: use shim-15.8 for gnu-efi branch

2024-01-22T19:17:20+00:00

Signed-off-by: Peter Jones

Try to load revocations.efi even if directory read fails

2024-01-22T19:17:20+00:00

Network booting tends to expose things like a tfpt server as a filesystem that doesn't implement directory listing This will blindly try to ingest a revocations.efi file in those cases, even if that may result in some console noise when the file does not exist. Signed-off-by: Jan Setje-Eilers

netboot read_image() should not hardcode DEFAULT_LOADER

2024-01-22T19:17:20+00:00

The netboot path up until now hardcodes DEFAULT_LOADER as the only possible filename to load. This is pretty limiting and needs to be fixed. Signed-off-by: Jan Setje-Eilers

Build time selectable automatic SBATLevel revocations

2024-01-22T19:17:20+00:00

The ability to automatically apply SBATLevel revocations varies from distro to distro. This allows distros that are able to automatically apply SBATLevel revocations when shim is updated to select a level by supplying SBAT_AUTOMATIC_DATE= on the make command line. Currently the following options are available: 2021030218 no revocations - useful for distros that need to rely on an externally delivered revocations.efi 2022052400 grub,2 2022111500 shim,2 grub,3 2023012900 shim,2 grub,3 grub.debian,4 If no datestamp is specified the build will default to the most recent 2023012900. Signed-off-by: Jan Setje-Eilers

Rename "previous" revocations to "automatic"

2024-01-22T19:17:20+00:00

When the term previous was introduced for revocations to be automatically applied there was a hope that everytime a new revocation was built into shim, the previous revocation could be applied automatically. Further experience has shown the real world to be more complex than that. The automatic payload will realistically contain a set of revocations governed by both the cadence at which a distro's customer base updates as well as the severity of the issue being revoked. This is not a functional change. Signed-off-by: Jan Setje-Eilers

Suppress "Failed to open <..>\revocations.efi" when file does not exist

2024-01-22T19:17:20+00:00

Attempting to call loadimage on revocations.efi when it isn't present should results in error messages being printed to the console on at least some firmware: Failed to open \EFI\distro\revocations.efi - Not Found Failed to load image ...: Not Found Of course this is going to be the normal case on nearly all systems, at least to begin with. Since we are about to loop through the directory entries anyway, we can just make two passes, first looking for revocations.efi and then looking for shim_certificate.efi. This will still ensure that any revocations in revocations.efi are picked up before shim_certificate.efi is loaded without resulting in any noise on the console. Signed-off-by: Jan Setje-Eilers

pe-relocate: Avoid __builtin_add_overflow() on GCC < 5

2024-01-22T19:17:20+00:00

GCC 4 doesn't have __builtin_add_overflow() and friends, so this results in a compiler error. On platforms using that version, do the arithmetic without it. Signed-off-by: Peter Jones

post-process-pe: Don't set the NX_COMPAT flag by default after all.

2024-01-22T19:17:20+00:00

We thought we would fully support NX compatibility in the full stack for this release, but all of the necessary components aren't *quite* ready for this release. This patch switches back the default that was changed in a53b9f7ceec1d, but it leaves the build infrastructure in place. Signed-off-by: Peter Jones

Fix some minor ia32 build issues.

2024-01-22T19:17:20+00:00

Several of our CVE fixes apparently were not well tested on 32-bit, and needed some (uintptr_t) casts sprinkled about to build with -Werror=pointer-to-int-cast. Signed-off-by: Peter Jones