peperunas/harden
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

findEFIVariables: Added metadata, fixed logic by matching on the call and not the expr

Browse Source
This commit is contained in:
Giulio De Pasquale 2023-02-19 21:15:12 -08:00
parent 4368e65b49
commit 5dec732ae5
1 changed files with 23 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
codeql/harden/SmmHarden/findEFIVariables.ql
View File

@ -1,3 +1,16 @@
/**
* @name Find uses of EFI variables
* @description Finds all uses of EFI variables in a C/C++ codebase.
* @kind problem
* @problem.severity warning
* @id cpp/find-uses-of-efi-variables
* @tags security
* efi
* external interface
* @precision low
* @queryLanguages cpp
*/
import cpp import cpp
import semmle.code.cpp.security.FlowSources import semmle.code.cpp.security.FlowSources
import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
@ -18,25 +31,23 @@ class EFIVarPtrFunction extends PointerFieldAccess {
} }
predicate callHandlesEFIVariable(Expr e, Call c) { predicate callHandlesEFIVariable(Expr e, Call c) {
exists(Call x, PointerFieldAccess fa | exists(Call x |
// in case it is just a normal function call // in case it is just a normal function call
x.getParent() = e and x.getTarget() instanceof EFIVarFunction (x = c and x.getParent() = e and x.getTarget() instanceof EFIVarFunction)
or )
or
exists(VariableCall vc, PointerFieldAccess fa |
// in case the function call is actually a pointer field access, the function name will be the name of the field itself // in case the function call is actually a pointer field access, the function name will be the name of the field itself
c = x and c = vc and
c instanceof VariableCall and vc.getParent() = e and
fa instanceof EFIVarPtrFunction and fa instanceof EFIVarPtrFunction and
x.getParent() = e and vc.getVariable() = fa.getTarget()
c.(VariableCall).getVariable() = fa.getTarget()
) )
} }
class EFIVar extends Variable { class EFIVar extends Variable {
EFIVar() { exists(Expr e | callHandlesEFIVariable(e, _) and e.(Access).getTarget() = this) } EFIVar() { exists(Call c | callHandlesEFIVariable(_, c) and c.getAnArgument().(Access).getTarget() = this) }
} }
from Expr e, Call c, Variable v from EFIVar v
where
callHandlesEFIVariable(e, c) and
e.(Access).getTarget() = v
select v, "This expression uses EFI variables" select v, "This expression uses EFI variables"