Skip to content

Commit c13742b

Browse files
Jian J Wangmergify[bot]
Jian J Wang
authored andcommitted
SecurityPkg/DxeImageVerificationLib: reject CertStack.CertNumber==0 per DBX (CVE-2019-14575)
In case the signers' certificate stack, retrieved from the PE/COFF image's Authenticode blob, has zero elements (=there are zero signer certificates), then we should consider the image forbidden by DBX, not accepted by DBX. Cc: Jiewen Yao <[email protected]> Cc: Chao Zhang <[email protected]> Signed-off-by: Jian J Wang <[email protected]> Reviewed-by: Laszlo Ersek <[email protected]> Reviewed-by: Jiewen Yao <[email protected]>
1 parent fbb9607 commit c13742b

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1326,7 +1326,7 @@ IsForbiddenByDbx (
13261326
// UINT8 Certn[];
13271327
//
13281328
Pkcs7GetSigners (AuthData, AuthDataSize, &CertBuffer, &BufferLength, &TrustedCert, &TrustedCertLength);
1329-
if ((BufferLength == 0) || (CertBuffer == NULL)) {
1329+
if ((BufferLength == 0) || (CertBuffer == NULL) || (*CertBuffer) == 0) {
13301330
IsForbidden = TRUE;
13311331
goto Done;
13321332
}

0 commit comments

Comments
 (0)