NetworkPkg: SECURITY PATCH CVE-2023-45237

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4542

Bug Overview:
PixieFail Bug #9
CVE-2023-45237
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Use of a Weak PseudoRandom Number Generator

Change Overview:

Updates all Instances of NET_RANDOM (NetRandomInitSeed ()) to either

>
> EFI_STATUS
> EFIAPI
> PseudoRandomU32 (
>  OUT UINT32  *Output
>  );
>

or (depending on the use case)

>
> EFI_STATUS
> EFIAPI
> PseudoRandom (
>  OUT  VOID   *Output,
>  IN   UINTN  OutputLength
>  );
>

This is because the use of

Example:

The following code snippet PseudoRandomU32 () function is used:

>
> UINT32         Random;
>
> Status = PseudoRandomU32 (&Random);
> if (EFI_ERROR (Status)) {
>   DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n",
__func__, Status));
>   return Status;
> }
>

This also introduces a new PCD to enable/disable the use of the
secure implementation of algorithms for PseudoRandom () and
instead depend on the default implementation. This may be required for
some platforms where the UEFI Spec defined algorithms are not available.

>
> PcdEnforceSecureRngAlgorithms
>

If the platform does not have any one of the UEFI defined
secure RNG algorithms then the driver will assert.

Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>

Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
index b22cef4ff5..f964515b0f 100644
--- a/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
+++ b/NetworkPkg/HttpBootDxe/HttpBootDhcp6.c
@@ -2,6 +2,7 @@
   Functions implementation related with DHCPv6 for HTTP boot driver.

 

 Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>

+Copyright (c) Microsoft Corporation

 SPDX-License-Identifier: BSD-2-Clause-Patent

 

 **/

@@ -951,6 +952,7 @@ HttpBootDhcp6Sarr (
   UINT32                    OptCount;

   UINT8                     Buffer[HTTP_BOOT_DHCP6_OPTION_MAX_SIZE];

   EFI_STATUS                Status;

+  UINT32                    Random;

 

   Dhcp6 = Private->Dhcp6;

   ASSERT (Dhcp6 != NULL);

@@ -961,6 +963,12 @@ HttpBootDhcp6Sarr (
   OptCount = HttpBootBuildDhcp6Options (Private, OptList, Buffer);

   ASSERT (OptCount > 0);

 

+  Status = PseudoRandomU32 (&Random);

+  if (EFI_ERROR (Status)) {

+    DEBUG ((DEBUG_ERROR, "%a failed to generate random number: %r\n", __func__, Status));

+    return Status;

+  }

+

   Retransmit = AllocateZeroPool (sizeof (EFI_DHCP6_RETRANSMISSION));

   if (Retransmit == NULL) {

     return EFI_OUT_OF_RESOURCES;

@@ -976,7 +984,7 @@ HttpBootDhcp6Sarr (
   Config.IaInfoEvent           = NULL;

   Config.RapidCommit           = FALSE;

   Config.ReconfigureAccept     = FALSE;

-  Config.IaDescriptor.IaId     = NET_RANDOM (NetRandomInitSeed ());

+  Config.IaDescriptor.IaId     = Random;

   Config.IaDescriptor.Type     = EFI_DHCP6_IA_TYPE_NA;

   Config.SolicitRetransmission = Retransmit;

   Retransmit->Irt              = 4;