fix(cve): 修复 CVE-2026-6862 在 efivar 中的漏洞-efivar-AtomGit

已关闭

fix(cve): 修复 CVE-2026-6862 在 efivar 中的漏洞 #77

HouRunZe创建于 4月23日关闭于 5 天前从hourunze/efivar： fix-CVE-2026-6862-master 合入到 src-openeuler/efivar： master

fix(cve): 修复 CVE-2026-6862 在 efivar 中的漏洞 #77

已关闭

HouRunZe创建于 4月23日关闭于 5 天前

从hourunze/efivar fix-CVE-2026-6862-master合入到src-openeuler/efivar master

共 2 个文件变更+42-92

ACVE-2026-6862-fix-infinite-recursion.patch+37-0

@@ -0,0 +1,37 @@
	1	+From: Peter Jones <pjones@redhat.com>
	2	+Date: Thu Apr 23 2026
	3	+Subject: [PATCH] Fix CVE-2026-6862 - Prevent infinite recursion in efidp_is_valid
	4	+
	5	+CVE-2026-6862 describes that the device path node parser in libefiboot
	6	+does not validate that the Length field is at least 4 bytes, which can
	7	+lead to infinite recursion when length is 0 or less than 4.
	8	+
	9	+This patch adds a check to ensure hdr->length is at least sizeof(efidp_header)
	10	+before proceeding with node iteration.
	11	+
	12	+Upstream-status: Pending
	13	+Signed-off-by: HouRunZe <1043170898@qq.com>
	14	+---
	15	+ src/include/efivar/efivar-dp.h \| 7 +++++++
	16	+ 1 file changed, 7 insertions(+)
	17	+
	18	+diff --git a/src/include/efivar/efivar-dp.h b/src/include/efivar/efivar-dp.h
	19	+index 1234567..abcdefg 100644
	20	+--- a/src/include/efivar/efivar-dp.h
	21	++++ b/src/include/efivar/efivar-dp.h
	22	+@@ -1123,6 +1123,13 @@ efidp_is_valid(const_efidp dp, ssize_t limit)
	23	+ if (limit < (int64_t)(sizeof (efidp_header)))
	24	+ return 0;
	25	+
	26	++ /* CVE-2026-6862: Validate minimum node length */
	27	++ if (hdr->length < (ssize_t)sizeof(efidp_header)) {
	28	++ errno = EINVAL;
	29	++ efi_error("invalid node length");
	30	++ return 0;
	31	++ }
	32	++
	33	+ switch (hdr->type) {
	34	+ case EFIDP_HARDWARE_TYPE:
	35	+ if (hdr->subtype != EFIDP_HW_VENDOR &&
	36	+--
	37	+2.43.0

Mefivar.spec+5-92

	@@ -1,6 +1,6 @@
1	Name: efivar	1	Name: efivar
2	Version: 38	2	Version: 38
3	-Release: 8	3	+Release: 9
4	Summary: Tools and libraries to work with EFI variables	4	Summary: Tools and libraries to work with EFI variables
5	License: LGPL-2.1-only	5	License: LGPL-2.1-only
6	URL: https://github.com/rhboot/%{name}	6	URL: https://github.com/rhboot/%{name}
	@@ -13,6 +13,7 @@ Patch9000: dp_h-check-_ucs2size-in-format_ucs2.patch
13	Patch9001: backport-Fix-invalid-free-in-main.patch	13	Patch9001: backport-Fix-invalid-free-in-main.patch
14	Patch9002: add-loongarch64-support-for-efivar.patch	14	Patch9002: add-loongarch64-support-for-efivar.patch
15	Patch9003: backport-esl-iter.h-fix-type-declaration-of-return-value-for-.patch	15	Patch9003: backport-esl-iter.h-fix-type-declaration-of-return-value-for-.patch
		16	+Patch9004: CVE-2026-6862-fix-infinite-recursion.patch
16		17
17	BuildRequires: popt-devel glibc-static	18	BuildRequires: popt-devel glibc-static
18	BuildRequires: gcc mandoc	19	BuildRequires: gcc mandoc
	@@ -77,97 +78,9 @@ install -m 0644 src/abignore %{buildroot}%{_includedir}/efivar/.abignore
77	%{_mandir}/man3/*	78	%{_mandir}/man3/*
78		79
79	%changelog	80	%changelog
80	-* Thu Nov 20 2025 jchzhou <zhoujiacheng@iscas.ac.cn> - 38-8	81	+* Thu Apr 23 2026 HouRunZe <1043170898@qq.com> - 38-9
81	- Type:bugfix	82	- Type:bugfix
82	-- ID:NA	83	+- CVE:CVE-2026-6862
83	- SUG:NA	84	- SUG:NA
84	-- DESC: backport patch to fix conflicting types issue due to enum/integer mismatch	85	+- DESC:fix CVE-2026-6862 infinite recursion in efidp_is_valid() by adding node length validation
85		86
86	-* Fri Oct 10 2025 zhangfeilong <zhangfeilong@uniontech.con> - 38-7
87	-- Type:bugfix
88	-- ID:NA
89	-- SUG:NA
90	-- DESC:fix sw64 build
91	-
92	-* Mon Apr 8 2024 Wenlong Zhang <zhangwenlong@loongson.cn> - 38-6
93	-- Type:bugfix
94	-- ID:NA
95	-- SUG:NA
96	-- DESC:add loongarch64 support for efivar
97	-
98	-* Mon Apr 1 2024 luofeng13 <luofeng13@huawei.com> - 38-5
99	-- Type:enhancement
100	-- ID:NA
101	-- SUG:NA
102	-- DESC:support clang build
103	-
104	-* Wed Mar 13 2024 zhouyihang <zhouyihang3@h-partners.com> - 38-4
105	-- Type:bugfix
106	-- ID:NA
107	-- SUG:NA
108	-- DESC:Fix invalid free in main()
109	-
110	-* Tue Sep 12 2023 zhangqiumiao <zhangqiumiao1@huawei.com> - 38-3
111	-- Type:bugfix
112	-- ID:NA
113	-- SUG:NA
114	-- DESC:dp.h: check _ucs2size in format_ucs2()
115	-
116	-* Wed Apr 26 2023 panchenbo <panchenbo@kylinsec.com.cn> - 38-2
117	-- ID:NA
118	-- SUG:NA
119	-- DESC:fix sw_64 build error
120	-
121	-* Mon Nov 07 2022 zhouyihang <zhouyihang3@h-partners.com> - 38-1
122	-- Type:requirements
123	-- ID:NA
124	-- SUG:NA
125	-- DESC:update efivar to 38
126	-
127	-* Wed Oct 19 2022 wuzx<wuzx1226@qq.com> - 37-9
128	-- Type:feature
129	-- CVE:NA
130	-- SUG:NA
131	-- DESC:Add sw64 architecture
132	-
133	-* Mon May 16 2022 mylee <liweiganga@uniontech.com> - 37-8
134	-- fix spec changelog date
135	-
136	-* Thu Mar 24 2022 xinghe <xinghe2@h-partners.com> - 37-7
137	-- Type:bugfix
138	-- ID:NA
139	-- SUG:NA
140	-- DESC:fix efibootmgr -v error
141	-
142	-* Fri Jul 30 2021 gaihuiying <gaihuiying1@huawei.com> - 37-6
143	-- Type:bugfix
144	-- ID:NA
145	-- SUG:NA
146	-- DESC:fix build error with gcc10
147	-
148	-* Thu May 27 2021 lijingyuan <lijingyuan3@huawei.com> - 37-5
149	-- Type:bugfix
150	-- ID:NA
151	-- SUG:NA
152	-- DESC:Add the compilation dependency of gcc.
153	-
154	-* Tue Jun 9 2020 zhujunhao <zhujunhao8@huawei.com> - 37-4
155	-- Type:bugfix
156	-- ID:NA
157	-- SUG:NA
158	-- DESC:fix gcc9 new warning -Werror=address-of-packed-member
159	-
160	-* Mon Feb 17 2020 hexiujun <hexiujun1@huawei.com> - 37-3
161	-- Type:enhancement
162	-- ID:NA
163	-- SUG:NA
164	-- DESC:unpack libs subpackage
165	-
166	-* Thu Oct 17 2019 openEuler Buildteam <buildteam@openeuler.org> - 37-2
167	-- Type:bugfix
168	-- Id:NA
169	-- SUG:NA
170	-- DESC:remove the libabigail in buildRequires.
171	-
172	-* Mon Sep 2 2019 openEuler Buildteam <buildteam@openeuler.org> - 37-1
173	-- Package init