ACK: [SRU][OEM-5.17][PATCH 0/1] CVE-2022-40307

[Andrei Gherzan]

On 23/04/04 04:23PM, Yuxuan Luo wrote:
> [Impact]
> There is a race condition that occurs in drivers/firmware/efi, between the
> efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops,
> which ultimately results in UAF.
> 
> [Backport]
> It is a clean cherry pick.
> 
> [Test]
> Compile and boot tested.
> There is a proof of concept for this CVE, though, the prerequisite command,
> installing the efi_capsule_loader, fails as "No such device", indicating a
> requirement for physical hardware.
> The link to the PoC: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/
> 
> [Potential Regression]
> Should be trivial.
> 
> Hyunwoo Kim (1):
>   efi: capsule-loader: Fix use-after-free in efi_capsule_write
> 
>  drivers/firmware/efi/capsule-loader.c | 31 ++++++---------------------
>  1 file changed, 7 insertions(+), 24 deletions(-)
> 
> -- 
> 2.34.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20230405/8c2dda2f/attachment.sig>