Stack Exhaustion DoS in libefiboot Device Path Parser

Executive Summary

This vulnerability exists in libefiboot, a part of the efivar component used for EFI variable handling on Linux systems. The flaw is in the device path node parser, which does not properly check that the Length field of each device path node is at least 4 bytes, the minimum size required for an EFI device path node header.

A local user can exploit this by providing a specially crafted device path node with a Length field smaller than 4 bytes. This causes infinite recursion between two functions, leading to stack exhaustion, a stack overflow, and ultimately crashing the process.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to the libefiboot library used in EFI variable handling on Linux systems and involves a flaw in the device path node parser. Detection involves checking for the presence of vulnerable versions of the efivar or libefiboot components on your system.

Since the vulnerability is triggered by processing specially crafted device path nodes locally, network detection is not applicable. Instead, detection can be done by verifying the installed package versions or by monitoring for crashes or denial of service symptoms in processes using efivar.

Suggested commands to detect if your system is potentially vulnerable include checking the installed efivar package version, for example:

• rpm -q efivar
• dpkg -l | grep efivar

Additionally, monitoring system logs for crashes related to efivar or libefiboot processes may help identify exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial of service (DoS) condition. When exploited, it causes the affected process to crash due to stack exhaustion from infinite recursion.

This means that a local user could cause the efivar component or related processes to stop functioning, potentially disrupting system operations that rely on EFI variable handling.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability described is a denial of service (DoS) issue caused by infinite recursion leading to a process crash. It does not involve unauthorized access, data leakage, or modification of sensitive information.

As such, there is no direct indication from the provided information that this vulnerability impacts compliance with common standards and regulations like GDPR or HIPAA, which primarily focus on protecting personal data confidentiality, integrity, and availability.

However, denial of service conditions can indirectly affect availability requirements under these regulations, but the provided context does not specify any compliance impact or mitigation related to these standards.

Useful 0 Not Useful 0

Mitigation Strategies

The suggested fix is to update the libefiboot component to include a guard clause in the device path node parser that checks if the node length is less than 4 bytes and returns an error to prevent infinite recursion.

Specifically, the fix involves adding a check such as: if (dp->length < 4) return -1;

Therefore, immediate mitigation steps include applying patches or updates from the upstream efivar project or your Linux distribution that address this issue.

Useful 0 Not Useful 0