From nobody Tue Aug 25 16:00:22 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTstt3Tzdz6pbPq for ; Tue, 25 Aug 2026 16:00:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTstt198qz42wH for ; Tue, 25 Aug 2026 16:00:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cgfYenHs0OpPW5o3XgbD9yPgYOfE8ivW5wZpjOI649k=; b=RVpQdDseS23GZbNyTWGyCVWNO7Ek9W0qb6PArEtyhNtcdta2ca855GMTYgdUMjdKRid27h UMHBCmrT+5+ilXkewPcEqWX3QYwUTmQmEdGz4QqeQmglA/xp4rn/mm7TkFy1VkVc4uzh81 w7wKp601oTTqIaNlyCuDQzUIjuXL2R3FsaBOHLDwuihyNMVhs2Ujow3e9w4hH82VogSFbG 2FqxPr30DbKLm59okfOR4LzF1HRPC8wya3ZJFrUXY4r6xG2Ir95CSfWDVeoXvSzn7LHayR b9Y76f1ckYRQIG07ssgKIVcp03stRPG3m1l4SFCjf/Z/OfJZjauAvjp5Cor+1A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787673622; a=rsa-sha256; cv=none; b=U4Vzy15Ca4uAiFBJBTorvPt4E60thutPEVz572IYbasz7m+YoE98VwjsABGWnz4NJ0ETbU ZbOiF8YwzUGsSDrQBQlS2EcIWgH2ooh1H3GzcZzkgnuGUBZ0Maos3x0h7aIbgi6J5wWddZ GdCqEk04fpjfrerSUTnOCLe8JIUz8SjEC+/mfKDJAMzh4eR0GQ6m1ipJlAHkTvEggGnRYz cR7/G8rvdHezz9nJGSltFdOA+5FEUud4SOlQs6hmuJVnjKPfzbgZEns2aBzot0XEsVl6IX 2l7cUr3/XAkBIzsN1pR2I7nN2vfkbs6OUvjlC1catIOMbrcoqs2JekuNQz5Xww== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787673622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cgfYenHs0OpPW5o3XgbD9yPgYOfE8ivW5wZpjOI649k=; b=DQaGfpPeLEFy4HEmwdJMl6ocpu6JPiFz86P7FxuLW1xTCukSEmfu8Jhw6b0Z5prG3p/8ZQ XszkrIe5UYsTR66WqFYMZwUSuTdtWcJx5PfDOlqLwPOvoJd37BLhKs6hhTlurKvUtbXyrZ ajA+wUWOor8rr+mGvIJOzQUuhrxliN0DFMdvuASfOVCpJeaQL7dB1abVc/RHCCfK+F5cyA 5l+C2y1xGUak4u87sqpFJQQU9HvZ2fk4PPoeOc5tOsM6wL89DH05rN0zOW07vQf0QtDKvB Dh6sv2neEKr8ZOSle1aBAHzPllg6ch/BwU3c+o68XyAYghWX1ka01sLrAi8n8Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTstt0FXqzxW1 for ; Tue, 25 Aug 2026 16:00:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3263c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 25 Aug 2026 16:00:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: c905b341204e - releng/14.4 - ucode: Fix validation on Intel platforms List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.4 X-Git-Reftype: branch X-Git-Commit: c905b341204e92ce18c84b9ac33b643222c36d65 Auto-Submitted: auto-generated Date: Tue, 25 Aug 2026 16:00:22 +0000 Message-Id: <6a8dbc16.3263c.2b3b9643@gitrepo.freebsd.org> The branch releng/14.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=c905b341204e92ce18c84b9ac33b643222c36d65 commit c905b341204e92ce18c84b9ac33b643222c36d65 Author: Mark Johnston AuthorDate: 2026-05-27 20:18:05 +0000 Commit: Mark Johnston CommitDate: 2026-08-19 19:00:58 +0000 ucode: Fix validation on Intel platforms The check for the extended signature table was backwards, so we always ignored it. We should verify that the extended signature table fits within the total image size. Approved by: so Security: FreeBSD-EN-26:20.microcode Reviewed by: jrm, kib MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D57209 (cherry picked from commit 0beb172898499fff51eed4df3d9284cd1094afbb) (cherry picked from commit 38cbd2588f0b6f677f42287af425ac913da46294) --- sys/x86/x86/ucode.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/sys/x86/x86/ucode.c b/sys/x86/x86/ucode.c index 298ce5448853..9233e9fa93a8 100644 --- a/sys/x86/x86/ucode.c +++ b/sys/x86/x86/ucode.c @@ -179,7 +179,6 @@ ucode_intel_match(const uint8_t *data, size_t *len) uint64_t platformid; size_t resid; uint32_t data_size, flags, regs[4], sig, total_size; - int i; do_cpuid(1, regs); sig = regs[0]; @@ -201,19 +200,35 @@ ucode_intel_match(const uint8_t *data, size_t *len) if (total_size == 0) total_size = UCODE_INTEL_DEFAULT_DATA_SIZE + sizeof(struct ucode_intel_header); - if (data_size > total_size + sizeof(struct ucode_intel_header)) + + if (total_size > data_size + sizeof(struct ucode_intel_header)) table = (const struct ucode_intel_extsig_table *) ((const uint8_t *)(hdr + 1) + data_size); else table = NULL; - if (hdr->processor_signature == sig) { - if ((hdr->processor_flags & flags) != 0) { - *len = data_size; - return (hdr + 1); + if (hdr->processor_signature == sig && + (hdr->processor_flags & flags) != 0) { + *len = data_size; + return (hdr + 1); + } + if (table != NULL) { + size_t extsize; + + extsize = total_size - + (data_size + sizeof(struct ucode_intel_header)); + if (extsize < sizeof(struct ucode_intel_extsig_table)) { + ucode_error = VERIFICATION_FAILED; + break; } - } else if (table != NULL) { - for (i = 0; i < table->signature_count; i++) { + extsize -= sizeof(struct ucode_intel_extsig_table); + for (uint32_t i = 0; i < table->signature_count; i++) { + if (extsize < sizeof(struct ucode_intel_extsig)) { + ucode_error = VERIFICATION_FAILED; + goto out; + } + extsize -= sizeof(struct ucode_intel_extsig); + entry = &table->entries[i]; if (entry->processor_signature == sig && (entry->processor_flags & flags) != 0) { @@ -223,6 +238,7 @@ ucode_intel_match(const uint8_t *data, size_t *len) } } } +out: return (NULL); }