arm64: shim crashes in SecureBoot mode w/ some firmware

Bug #1811722 reported by dann frazier on 2019-01-14
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
shim (Ubuntu)
Undecided
Unassigned
shim-signed (Ubuntu)
Undecided
Unassigned

Bug Description

On some firmware, attempting SecureBoot on arm64 will result in a crash. This is reproducible with a build of latest upstream EDK2 for the ArmVirtQemu target, but not with the older version we have packaged (edk2 0~20181115.85588389-2ubuntu1). The reason appears to be that our older version of edk2 had the firmware flash mapped at 0x0, which allowed NULL pointer dereferences to silently succeed. Latest upstream has changed that, so now such accesses result in a Synchronous Exception.

Even though we can boot in SecureBoot mode successfully with the old firmware, I've found that doing so results in a corrupted firmware image, making subsequent boots fail. It maybe that the memory access that leads to the Synchronous Exception on newer firmware is a write to the firmware region that is causing the corruption, and therefore the same underlying root cause.

Note that I can also reproduce this with latest upstream GRUB. I looked for possible fixes for this in shim upstream, in case it is a problem with how shim invokes GRUB - or an issue with the Protocols shim registers. The only change I see that might be relevant that we don't already have is "6df7a8f Fix for "Section 0 has negative size" error when loading fbaa64.efi", but I could still reproduce after applying that.

dann frazier (dannf) wrote :
description: updated

Doesn't look like a grub bug anymore. We can set back to New if necessary.

Changed in grub2-signed (Ubuntu):
status: New → Invalid
dann frazier (dannf) wrote :

There are actually 2 separate bugs. The first is a bug in gnu-efi, triggered by this call in shim's errlog.c:

size = SPrint(NULL, 0, L"%a:%d %a() ", file, line, func);

According to the gnu-efi source, "A size of 0 means there is no limit", but SPrint does not check for NULL as the first parameter, and happily dereferences it anyway.

The other issue I've reported in LP: #1811901.

Changed in gnu-efi (Ubuntu):
status: New → Confirmed
Changed in shim-signed (Ubuntu):
status: New → Confirmed
dann frazier (dannf) on 2019-01-15
summary: - arm64: GRUB crashes in SecureBoot mode w/ some firmware
+ arm64: shim crashes in SecureBoot mode w/ some firmware
dann frazier (dannf) wrote :

I've proposed a fix upstream:
  https://github.com/rhboot/shim/pull/173

dann frazier (dannf) on 2019-03-08
Changed in shim (Ubuntu):
status: New → In Progress
dann frazier (dannf) on 2019-03-28
Changed in gnu-efi (Ubuntu):
status: Confirmed → Invalid
Changed in shim (Ubuntu):
status: In Progress → Fix Committed
Changed in shim-signed (Ubuntu):
status: Confirmed → Fix Committed
no longer affects: gnu-efi (Ubuntu)
no longer affects: grub2-signed (Ubuntu)
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers