From 79af75f7776fc20b0d7eb6afe1e27c00fdb4b9b4 Mon Sep 17 00:00:00 2001 From: Simon Glass Date: Mon, 15 Feb 2021 17:08:06 -0700 Subject: fit: Don't allow verification of images with @ nodes When searching for a node called 'fred', any unit address appended to the name is ignored by libfdt, meaning that 'fred' can match 'fred@1'. This means that we cannot be sure that the node originally intended is the one that is used. Disallow use of nodes with unit addresses. Update the forge test also, since it uses @ addresses. CVE-2021-27138 Signed-off-by: Simon Glass Reported-by: Bruce Monroe Reported-by: Arie Haenel Reported-by: Julien Lenoir --- test/py/tests/vboot_forge.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'test/py/tests/vboot_forge.py') diff --git a/test/py/tests/vboot_forge.py b/test/py/tests/vboot_forge.py index 0fb7ef40247..b41105bd0e3 100644 --- a/test/py/tests/vboot_forge.py +++ b/test/py/tests/vboot_forge.py @@ -376,12 +376,12 @@ def manipulate(root, strblock): """ Maliciously manipulates the structure to create a crafted FIT file """ - # locate /images/kernel@1 (frankly, it just expects it to be the first one) + # locate /images/kernel-1 (frankly, it just expects it to be the first one) kernel_node = root[0][0] # clone it to save time filling all the properties fake_kernel = kernel_node.clone() # rename the node - fake_kernel.name = b'kernel@2' + fake_kernel.name = b'kernel-2' # get rid of signatures/hashes fake_kernel.children = [] # NOTE: this simply replaces the first prop... either description or data @@ -391,13 +391,13 @@ def manipulate(root, strblock): root[0].children.append(fake_kernel) # modify the default configuration - root[1].props[0].value = b'conf@2\x00' + root[1].props[0].value = b'conf-2\x00' # clone the first (only?) configuration fake_conf = root[1][0].clone() # rename and change kernel and fdt properties to select the crafted kernel - fake_conf.name = b'conf@2' - fake_conf.props[0].value = b'kernel@2\x00' - fake_conf.props[1].value = b'fdt@1\x00' + fake_conf.name = b'conf-2' + fake_conf.props[0].value = b'kernel-2\x00' + fake_conf.props[1].value = b'fdt-1\x00' # insert the new configuration under /configurations root[1].children.append(fake_conf) -- cgit v1.2.3