From b33fd8ab1caa07aeb290ef5dac44a4e7fd4be02b Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Tue, 12 May 2026 08:05:23 +0200 Subject: [PATCH 1/2] hw/uefi: check auth.hdr_length minimum size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit auth.hdr_length maximum is already checked (against buffer size). The header has some fixed fields which are included in the header length, so there also is a minimum size which must be verified. Add a check for that. Fixes possible integer underflow. While being at it replace the magic number '24' with sizeof calculations for better code documentation. Fixes: CVE-2026-8341 Fixes: f1488fac0584 ("hw/uefi: add var-service-auth.c") Reported-by: Feifan Qian Reviewed-by: Daniel P. Berrangé Signed-off-by: Gerd Hoffmann Message-ID: <20260512060523.17493-1-kraxel@redhat.com> --- hw/uefi/var-service-auth.c | 5 ++++- hw/uefi/var-service-pkcs7.c | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/uefi/var-service-auth.c b/hw/uefi/var-service-auth.c index 795f2f54e4..f3dc9c6ca6 100644 --- a/hw/uefi/var-service-auth.c +++ b/hw/uefi/var-service-auth.c @@ -194,7 +194,7 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars_state *uv, return EFI_SUCCESS; } - if (auth.hdr_length == 24) { + if (auth.hdr_length == (sizeof(auth) - sizeof(auth.timestamp))) { /* no signature (auth->cert_data is empty) */ return EFI_SECURITY_VIOLATION; } @@ -228,6 +228,9 @@ efi_status uefi_vars_check_auth_2(uefi_vars_state *uv, uefi_variable *var, } memcpy(&auth, data, sizeof(auth)); + if (auth.hdr_length < (sizeof(auth) - sizeof(auth.timestamp))) { + return EFI_SECURITY_VIOLATION; + } if (uadd64_overflow(sizeof(efi_time), auth.hdr_length, &data_offset)) { return EFI_SECURITY_VIOLATION; } diff --git a/hw/uefi/var-service-pkcs7.c b/hw/uefi/var-service-pkcs7.c index c859743e86..8a1f1395a2 100644 --- a/hw/uefi/var-service-pkcs7.c +++ b/hw/uefi/var-service-pkcs7.c @@ -113,9 +113,9 @@ static gnutls_datum_t *build_pkcs7(void *data) memcpy(&auth, data, sizeof(auth)); pkcs7 = g_new(gnutls_datum_t, 1); - pkcs7->size = auth.hdr_length - 24; + pkcs7->size = auth.hdr_length - (sizeof(auth) - sizeof(auth.timestamp)); pkcs7->data = g_malloc(pkcs7->size); - memcpy(pkcs7->data, data + 16 + 24, pkcs7->size); + memcpy(pkcs7->data, data + sizeof(auth), pkcs7->size); wrap_pkcs7(pkcs7); From b25c602ec22ca472f98e6154bc60571902011618 Mon Sep 17 00:00:00 2001 From: Luigi Leonardi Date: Tue, 12 May 2026 17:14:12 +0200 Subject: [PATCH 2/2] hw/i386/microvm: Add IGVM support The IGVM infrastructure operates on X86MachineState and is already machine-type-agnostic, but the "igvm-cfg" QOM property is only registered on the PC machine type. Register it on microvm as well. When an IGVM file is configured, the firmware image is provided as a payload of the IGVM file so skip loading the default BIOS. Signed-off-by: Luigi Leonardi Message-ID: <20260512-microvm_igvm-v1-1-8b1fd8861235@redhat.com> Signed-off-by: Gerd Hoffmann --- hw/i386/microvm.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c index 5a7889f21b..779741ec76 100644 --- a/hw/i386/microvm.c +++ b/hw/i386/microvm.c @@ -159,7 +159,6 @@ static int microvm_ioapics(MicrovmMachineState *mms) static void microvm_devices_init(MicrovmMachineState *mms) { - const char *default_firmware; X86MachineState *x86ms = X86_MACHINE(mms); ISABus *isa_bus; GSIState *gsi_state; @@ -276,10 +275,12 @@ static void microvm_devices_init(MicrovmMachineState *mms) serial_hds_isa_init(isa_bus, 0, 1); } - default_firmware = x86_machine_is_acpi_enabled(x86ms) - ? MICROVM_BIOS_FILENAME - : MICROVM_QBOOT_FILENAME; - x86_bios_rom_init(x86ms, default_firmware, get_system_memory(), true); + if (!x86ms->igvm) { + const char *default_firmware = x86_machine_is_acpi_enabled(x86ms) + ? MICROVM_BIOS_FILENAME + : MICROVM_QBOOT_FILENAME; + x86_bios_rom_init(x86ms, default_firmware, get_system_memory(), true); + } } static void microvm_memory_init(MicrovmMachineState *mms) @@ -717,6 +718,16 @@ static void microvm_class_init(ObjectClass *oc, const void *data) compat_props_add(mc->compat_props, microvm_properties, G_N_ELEMENTS(microvm_properties)); + +#if defined(CONFIG_IGVM) + object_class_property_add_link(oc, "igvm-cfg", + TYPE_IGVM_CFG, + offsetof(X86MachineState, igvm), + object_property_allow_set_link, + OBJ_PROP_LINK_STRONG); + object_class_property_set_description(oc, "igvm-cfg", + "Set IGVM configuration"); +#endif } static const TypeInfo microvm_machine_info = {