[S] Change in coreboot[master]: cbfs: Allow controlling decompression of unverified files

[Lean Sheng Tan (Code Review)]

Lean Sheng Tan has submitted this change. ( https://review.coreboot.org/c/coreboot/+/75457?usp=email )

Change subject: cbfs: Allow controlling decompression of unverified files
......................................................................

cbfs: Allow controlling decompression of unverified files

This patch adds a new Kconfig that controls whether CBFS APIs for
unverified areas will allow file decompression when CBFS verification is
enabled. This should be disallowed by default because it exposes the
attack surface of all supported decompression algorithms. Make
allowances for one legacy use case with CONFIG_SOC_INTEL_CSE_LITE_
COMPRESS_ME_RW that should become obsolete with VBOOT_CBFS_INTEGRATION.

Signed-off-by: Julius Werner 
Change-Id: Ieae420f51cbc01dae2ab265414219cc9c288087b
Reviewed-on: https://review.coreboot.org/c/coreboot/+/75457
Reviewed-by: Jakub Czapiga 
Reviewed-by: Subrata Banik 
Tested-by: build bot (Jenkins) 
Reviewed-by: Yu-Ping Wu 
Reviewed-by: Angel Pons 
---
M src/lib/Kconfig.cbfs_verification
M src/lib/cbfs.c
M src/soc/intel/common/block/cse/Kconfig
3 files changed, 22 insertions(+), 0 deletions(-)

Approvals:
  Subrata Banik: Looks good to me, approved
  Jakub Czapiga: Looks good to me, approved
  build bot (Jenkins): Verified
  Angel Pons: Looks good to me, but someone else must approve
  Yu-Ping Wu: Looks good to me, but someone else must approve

diff --git a/src/lib/Kconfig.cbfs_verification b/src/lib/Kconfig.cbfs_verification
index 9b053e1..12aaf81 100644
--- a/src/lib/Kconfig.cbfs_verification
+++ b/src/lib/Kconfig.cbfs_verification
@@ -37,6 +37,20 @@
      bootblock is also safe against these vulnerabilities (i.e. there's no
      point in enabling this when you just rely on flash write-protection).

+config CBFS_ALLOW_UNVERIFIED_DECOMPRESSION
+	bool "Run decompression algorithms on potentially untrusted code"
+	default n
+	help
+	  This controls whether cbfs_unverified_area_...() access functions may
+	  decompress files. This exposes the attack surface of all supported
+	  decompression algorithms. Even if you don't compress the files you are
+	  planning to load with these functions, since file metadata is also
+	  unverified, an attacker can potentially replace them with compressed
+	  files to access a vulnerability in the decompression code.
+
+	  If you don't need to load compressed files from unverified areas, say
+	  no here for tighter security.
+
 config CBFS_HASH_ALGO
    int
    default 1 if CBFS_HASH_SHA1
diff --git a/src/lib/cbfs.c b/src/lib/cbfs.c
index 4e25d27..78eeb3b 100644
--- a/src/lib/cbfs.c
+++ b/src/lib/cbfs.c
@@ -208,6 +208,13 @@
    DEBUG("Decompressing %zu bytes from '%s' to %p with algo %d\n",
          in_size, mdata->h.filename, buffer, compression);

+	if (CONFIG(CBFS_VERIFICATION) && !CONFIG(CBFS_ALLOW_UNVERIFIED_DECOMPRESSION) &&
+	    skip_verification && compression != CBFS_COMPRESS_NONE) {
+		ERROR("Refusing to decompress unverified file '%s' with algo %d\n",
+		      mdata->h.filename, compression);
+		return 0;
+	}
+
    switch (compression) {
    case CBFS_COMPRESS_NONE:
    	if (buffer_size < in_size)
diff --git a/src/soc/intel/common/block/cse/Kconfig b/src/soc/intel/common/block/cse/Kconfig
index d809e03..876ec51 100644
--- a/src/soc/intel/common/block/cse/Kconfig
+++ b/src/soc/intel/common/block/cse/Kconfig
@@ -223,6 +223,7 @@
    bool
    default n
    depends on SOC_INTEL_CSE_LITE_SKU
+	select CBFS_ALLOW_UNVERIFIED_DECOMPRESSION if CBFS_VERIFICATION && !VBOOT_CBFS_INTEGRATION
    help
     Enable compression on Intel CSE CBFS RW blob