diff options
| author | John Mathews <john.mathews@intel.com> | 2025-05-30 11:06:49 -0700 |
|---|---|---|
| committer | John Mathews <john.mathews@intel.com> | 2025-08-04 08:15:19 -0700 |
| commit | d2d8d38ee08c5e602fb092f940dfecc1f5a4eb38 (patch) | |
| tree | 340e95450263a9ca7352a3ca0749d813080a513a | |
| parent | 7fe3609022ce7f52190bd6384d117f1510e15afe (diff) | |
| download | edk2-d2d8d38ee08c5e602fb092f940dfecc1f5a4eb38.tar.gz edk2-d2d8d38ee08c5e602fb092f940dfecc1f5a4eb38.zip | |
UefiCpuPkg/PiSmmCpuDxeSmm: Safe handling of IDT register on SMM entry
Mitigates CVE-2025-3770
Do not assume that IDT.limit is loaded with a zero value upon SMM entry.
Delay enabling Machine Check Exceptions in SMM until after the SMM IDT
has been reloaded.
Signed-off-by: John Mathews <john.mathews@intel.com>
| -rw-r--r-- | UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm index 644366ba19..6e1cd45c04 100644 --- a/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm +++ b/UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm @@ -113,7 +113,7 @@ ProtFlatMode: mov eax, strict dword 0 ; source operand will be patched
ASM_PFX(gPatchSmiCr3):
mov cr3, rax
- mov eax, 0x668 ; as cr4.PGE is not set here, refresh cr3
+ mov eax, 0x628 ; as cr4.PGE is not set here, refresh cr3
mov cl, strict byte 0 ; source operand will be patched
ASM_PFX(gPatch5LevelPagingNeeded):
@@ -204,6 +204,10 @@ SmiHandlerIdtrAbsAddr: mov ax, [rbx + DSC_SS]
mov ss, eax
+ mov rax, cr4 ; enable MCE
+ bts rax, 6
+ mov cr4, rax
+
mov rbx, [rsp + 0x8] ; rbx <- CpuIndex
; enable CET if supported
|