[PATCH 00/10] efi_loader: check PE images before using them

[Ana Bobillo <anabobillo3@gmail.com>]

U-Boot takes the offsets and sizes of a PE/COFF image from its headers
and uses them before it knows whether the image may run. With Secure
Boot on, efi_load_pe() authenticates the image first but goes on
copying and relocating it when authentication fails, and only then
returns EFI_SECURITY_VIOLATION; efi_image_parse(), which collects the
regions to hash, runs before the signature is checked, and so does the
walk of the certificate table. TCG2 measured boot parses every image as
well. So an image that will be refused, or one that is only measured,
can make U-Boot read or write outside its buffers, or hang.

This series checks those fields against the image where they are read,
along the lines of EDK2's PeCoffLoaderLib and DxeImageVerificationLib:

- patch 1 has efi_check_pe() check for a 64bit NT header again, as its
  comment says;
- patch 2 checks the headers, the sections and the certificate table in
  efi_image_parse(), and fails on errors of efi_image_region_add();
- patches 3-5 have efi_load_pe() reject, before allocating the image, a
  section whose end wraps around, section data past the end of the file
  and headers that do not fit into the image;
- patch 6 checks the relocation table against the image;
- patch 7 rejects a certificate table holding a certificate shorter than
  its header, which made the walk loop forever, or longer than the rest
  of the table;
- patch 8 refuses to load an image whose TCG2 measurement failed, as
  EDK2 does, instead of starting it unmeasured;
- patches 9 and 10 add unit tests and a Secure Boot test.

barebox, whose EFI loader is based on this file, made several of the
same changes this year; patches 2, 3 and 4 follow them and say so.

Valid images are unaffected: the unit tests check PE32 and PE32+ images
with 16, 6 or 5 data directories and an unpadded last section, the EFI
selftests and the Secure Boot tests pass, and each patch builds on its
own. Tested on sandbox.

CI: Azure build 13710 passed, all jobs, with this series on
https://github.com/u-boot/u-boot/pull/1064, a CI-only pull request,
merged with main 03e45557e1f:
https://dev.azure.com/u-boot/u-boot/_build/results?buildId=13710

Ana Bobillo (10):
  efi_loader: check the NT header size in efi_check_pe()
  efi_loader: check the PE image ranges in efi_image_parse()
  efi_loader: reject a PE section whose end wraps around
  efi_loader: check PE section raw data against the image size
  efi_loader: check that the PE headers fit into the loaded image
  efi_loader: check the relocation table against the image size
  efi_loader: check certificate lengths in efi_image_authenticate()
  efi_loader: do not load an image that cannot be measured
  test: lib: add tests for the PE image checks
  test: py: test invalid certificate lengths in signed images

 lib/efi_loader/efi_image_loader.c             | 368 +++++++++++----
 test/lib/Makefile                             |   2 +-
 test/lib/efi_image_loader.c                   | 442 ++++++++++++++++++
 test/py/tests/test_efi_secboot/conftest.py    |  31 ++
 test/py/tests/test_efi_secboot/test_signed.py |  36 ++
 5 files changed, 781 insertions(+), 98 deletions(-)
 create mode 100644 test/lib/efi_image_loader.c


base-commit: 03e45557e1f38a39a0c80fe30483130ff376cf92