search

rhboot / shim

UEFI shim loader
Other
816 stars 284 forks source link

mok: fix LogError() invocation #577

Closed vathpela closed 8 months ago

vathpela commented 1 year ago

On some ARM platform, jlinton noticed that when we fail to set a variable (because it isn't supported at all, presumably), our error message has an extra argument that doesn't match the format string.

This patch removes the extra argument.

alpernebbi commented 1 year ago

On some ARM platform, jlinton noticed that when we fail to set a variable (because it isn't supported at all, presumably), our error message has an extra argument that doesn't match the format string.

This has been triggering a Synchronous Abort on my chromebook (rk3399-gru-kevin) when trying to run Debian's signed shim with U-Boot, thanks for fixing it. From what I can tell, U-Boot now has QueryVariableInfo() available, but can misreport maximum variable size when its variable store buffer is about to run out, due to an underflow in size calculation probably here adressed by this patch. Debian's shim sets too many variables, and eventually SetVariable() fails with EFI_OUT_OF_RESOURCES and falls into this LogError.

eslerm commented 5 months ago

Is this issue actually a security vulnerability, or just a bug? Why was a CVE assigned?