OpenVariableRuntimeDxe: Add spoof proof UEFI 2.x checking
@@ -648,8 +648,10 @@ VariableServiceInitialize (
)
{
EFI_STATUS Status;
- EFI_EVENT ReadyToBootEvent;
+ UINTN OffsetQVI;
+ UINTN HeaderQVI;
EFI_EVENT EndOfDxeEvent;
+ EFI_EVENT ReadyToBootEvent;
EFI_CREATE_EVENT_EX OriginalCreateEventEx;
SaveAcpiGlobalVariable (SystemTable);
@@ -684,9 +686,19 @@ VariableServiceInitialize (
//
// Avoid setting UEFI 2.x interface member on EFI 1.x.
//
- if (SystemTable->RuntimeServices->Hdr.Revision >= EFI_2_00_SYSTEM_TABLE_REVISION) {
+ // First test all systable elements as some may have been spoofed and pass a limited element check
+ // Then check that QueryVariableInfo is specifically available before setting the interface member
+ //
+ if ( ((SystemTable->Hdr.Revision >> 16U) > 1)
+ && ((SystemTable->BootServices->Hdr.Revision >> 16U) > 1)
+ && ((SystemTable->RuntimeServices->Hdr.Revision >> 16U) > 1))
+ {
+ OffsetQVI = OFFSET_OF (EFI_RUNTIME_SERVICES, QueryVariableInfo);
+ HeaderQVI = OffsetQVI + sizeof (SystemTable->RuntimeServices->QueryVariableInfo);
+ if (SystemTable->RuntimeServices->Hdr.HeaderSize >= HeaderQVI) {
SystemTable->RuntimeServices->QueryVariableInfo = VariableServiceQueryVariableInfo;
}
+ }
//
// Now install the Variable Runtime Architectural protocol on a new handle.
