]> git.ipfire.org Git - thirdparty/u-boot.git/commit
efi_loader: fix use after free in efi_exit() with tcg2
authorVincent Stehlé <vincent.stehle@arm.com>
Tue, 27 Jan 2026 16:18:43 +0000 (17:18 +0100)
committerHeinrich Schuchardt <heinrich.schuchardt@canonical.com>
Fri, 6 Feb 2026 08:32:32 +0000 (09:32 +0100)
commitbeec6834544d8288d34ef0cd8e3c40aa890a8a10
tree6c92b3ed432c1e6ce295749981fc6af641674438
parentb5213bbfdcb1812be510427857827ee8becb9f8f
efi_loader: fix use after free in efi_exit() with tcg2

The efi_exit() function frees the loaded image memory by calling
efi_delete_image(). However, when CONFIG_EFI_TCG2_PROTOCOL is enabled, the
image_obj->image_type structure member is accessed after the memory has
been freed.

Fix this by performing the tcg2 measurement before the image deletion.

Fixes: 8fc4e0b4273a ("efi_loader: add boot variable measurement")
Suggested-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Tom Rini <trini@konsulko.com>
Cc: Masahisa Kojima <kojima.masahisa@socionext.com>
Acked-by: Masahisa Kojima <kojima.masahisa@socionext.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
lib/efi_loader/efi_boottime.c