Skip to content

Commit 56b4b9f

Browse files
pbatardpbatard
committed
[dbx] update SBAT/SVN to latest and improve reporting
* Explicitly report the SVN/SBAT number comparison in the log. * Also don't perform revocation checks on unsigned bootloaders. * Also add provision for CRLF handling when parsing our remote SBAT.
1 parent 2a8c066 commit 56b4b9f

File tree

4 files changed

+56
-46
lines changed

4 files changed

+56
-46
lines changed

‎src/db.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -150,8 +150,8 @@ static const char db_sb_revoked_txt[] =
150150
* Use as fallback when https://rufus.ie/sbat_level.txt cannot be accessed.
151151
*/
152152
static const char db_sbat_level_txt[] =
153-
"sbat,1,2024010900\n"
153+
"sbat,1,2025051000\n"
154154
"shim,4\n"
155-
"grub,3\n"
156-
"grub.debian,4\n"
157-
"BOOTMGRSECURITYVERSIONNUMBER,0x30000";
155+
"grub,5\n"
156+
"grub.proxmox,2\n"
157+
"BOOTMGRSECURITYVERSIONNUMBER,0x70000";

‎src/hash.c‎

Lines changed: 43 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -2198,8 +2198,11 @@ static BOOL IsRevokedBySbat(uint8_t* buf, uint32_t len)
21982198
if (entry.version == 0)
21992199
continue;
22002200
for (j = 0; sbat_entries[j].product != NULL; j++) {
2201-
if (strcmp(entry.product, sbat_entries[j].product) == 0 && entry.version < sbat_entries[j].version)
2201+
if (strcmp(entry.product, sbat_entries[j].product) == 0 && entry.version < sbat_entries[j].version) {
2202+
uprintf(" SBAT version for '%s' (%d) is lower than required minimum SBAT version (%d)!",
2203+
entry.product, entry.version, sbat_entries[j].version);
22022204
return TRUE;
2205+
}
22032206
}
22042207
}
22052208

@@ -2306,8 +2309,11 @@ static BOOL IsRevokedBySvn(uint8_t* buf, uint32_t len)
23062309
svn_ver = (uint32_t*)RvaToPhysical(buf, rsrc_rva);
23072310
if (svn_ver != NULL) {
23082311
uuprintf(" SVN version: %d.%d", *svn_ver >> 16, *svn_ver & 0xffff);
2309-
if (*svn_ver < sbat_entries[i].version)
2312+
if (*svn_ver < sbat_entries[i].version) {
2313+
uprintf(" SVN version %d.%d is lower than required minimum SVN version %d.%d!",
2314+
*svn_ver >> 16, *svn_ver & 0xffff, sbat_entries[i].version >> 16, sbat_entries[i].version & 0xffff);
23102315
return TRUE;
2316+
}
23112317
}
23122318
} else {
23132319
uprintf(" Warning: Unexpected Secure Version Number size");
@@ -2394,42 +2400,43 @@ int IsBootloaderRevoked(uint8_t* buf, uint32_t len)
23942400
// Get the signer/issuer info
23952401
cert = GetPeSignatureData(buf);
23962402
r = GetIssuerCertificateInfo(cert, &info);
2397-
if (r == 0)
2403+
if (r == 0) {
23982404
uprintf(" (Unsigned Bootloader)");
2399-
else if (r > 0)
2405+
} else if (r > 0) {
24002406
uprintf(" Signed by '%s'", info.name);
2401-
2402-
if (!PE256Buffer(buf, len, hash))
2403-
return -1;
2404-
// Check for UEFI DBX revocation
2405-
if (IsRevokedByDbx(hash, buf, len))
2406-
revoked = 1;
2407-
// Check for Microsoft SSP revocation
2408-
for (i = 0; revoked == 0 && i < pe256ssp_size * SHA256_HASHSIZE; i += SHA256_HASHSIZE)
2409-
if (memcmp(hash, &pe256ssp[i], SHA256_HASHSIZE) == 0)
2410-
revoked = 2;
2411-
// Check for Linux SBAT revocation
2412-
if (revoked == 0 && IsRevokedBySbat(buf, len))
2413-
revoked = 3;
2414-
// Check for Microsoft SVN revocation
2415-
if (revoked == 0 && IsRevokedBySvn(buf, len))
2416-
revoked = 4;
2417-
// Check for UEFI DBX certificate revocation
2418-
if (revoked == 0 && IsRevokedByCert(&info))
2419-
revoked = 5;
2420-
2421-
// If signed and not revoked, print the various Secure Boot "gotchas"
2422-
if (r > 0 && revoked == 0) {
2423-
if (strcmp(info.name, "Microsoft Windows Production PCA 2011") == 0) {
2424-
uprintf(" Note: This bootloader may fail Secure Boot validation on systems that");
2425-
uprintf(" have been updated to use the 'Windows UEFI CA 2023' certificate.");
2426-
} else if (strcmp(info.name, "Windows UEFI CA 2023") == 0) {
2427-
uprintf(" Note: This bootloader will fail Secure Boot validation on systems that");
2428-
uprintf(" have not been updated to use the latest Secure Boot certificates");
2429-
} else if (strcmp(info.name, "Microsoft Corporation UEFI CA 2011") == 0 ||
2430-
strcmp(info.name, "Microsoft UEFI CA 2023") == 0) {
2431-
uprintf(" Note: This bootloader may fail Secure Boot validation on *some* systems,");
2432-
uprintf(" unless you enable \"Microsoft 3rd-party UEFI CA\" in your 'BIOS'.");
2407+
// Only perform revocation checks on signed bootloaders
2408+
if (!PE256Buffer(buf, len, hash))
2409+
return -1;
2410+
// Check for UEFI DBX revocation
2411+
if (IsRevokedByDbx(hash, buf, len))
2412+
revoked = 1;
2413+
// Check for Microsoft SSP revocation
2414+
for (i = 0; revoked == 0 && i < pe256ssp_size * SHA256_HASHSIZE; i += SHA256_HASHSIZE)
2415+
if (memcmp(hash, &pe256ssp[i], SHA256_HASHSIZE) == 0)
2416+
revoked = 2;
2417+
// Check for Linux SBAT revocation
2418+
if (revoked == 0 && IsRevokedBySbat(buf, len))
2419+
revoked = 3;
2420+
// Check for Microsoft SVN revocation
2421+
if (revoked == 0 && IsRevokedBySvn(buf, len))
2422+
revoked = 4;
2423+
// Check for UEFI DBX certificate revocation
2424+
if (revoked == 0 && IsRevokedByCert(&info))
2425+
revoked = 5;
2426+
2427+
// If signed and not revoked, print the various Secure Boot "gotchas"
2428+
if (revoked == 0) {
2429+
if (strcmp(info.name, "Microsoft Windows Production PCA 2011") == 0) {
2430+
uprintf(" Note: This bootloader may fail Secure Boot validation on systems that");
2431+
uprintf(" have been updated to use the 'Windows UEFI CA 2023' certificate.");
2432+
} else if (strcmp(info.name, "Windows UEFI CA 2023") == 0) {
2433+
uprintf(" Note: This bootloader will fail Secure Boot validation on systems that");
2434+
uprintf(" have not been updated to use the latest Secure Boot certificates");
2435+
} else if (strcmp(info.name, "Microsoft Corporation UEFI CA 2011") == 0 ||
2436+
strcmp(info.name, "Microsoft UEFI CA 2023") == 0) {
2437+
uprintf(" Note: This bootloader may fail Secure Boot validation on *some* systems,");
2438+
uprintf(" unless you enable \"Microsoft 3rd-party UEFI CA\" in your 'BIOS'.");
2439+
}
24332440
}
24342441
}
24352442

‎src/parser.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1588,9 +1588,12 @@ sbat_entry_t* GetSbatEntries(char* sbatlevel)
15881588
return NULL;
15891589

15901590
num_entries = 1;
1591-
for (i = 0; sbatlevel[i] != '\0'; i++)
1591+
for (i = 0; sbatlevel[i] != '\0'; i++) {
15921592
if (sbatlevel[i] == '\n')
15931593
num_entries++;
1594+
if (sbatlevel[i] == '\r')
1595+
sbatlevel[i] = '\n';
1596+
}
15941597

15951598
sbat_list = calloc(num_entries + 1, sizeof(sbat_entry_t));
15961599
if (sbat_list == NULL)

‎src/rufus.rc‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ LANGUAGE LANG_NEUTRAL, SUBLANG_NEUTRAL
3333
IDD_DIALOG DIALOGEX 12, 12, 232, 326
3434
STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
3535
EXSTYLE WS_EX_ACCEPTFILES
36-
CAPTION "Rufus 4.11.2283"
36+
CAPTION "Rufus 4.11.2284"
3737
FONT 9, "Segoe UI Symbol", 400, 0, 0x0
3838
BEGIN
3939
LTEXT "Drive Properties",IDS_DRIVE_PROPERTIES_TXT,8,6,53,12,NOT WS_GROUP
@@ -408,8 +408,8 @@ END
408408
//
409409

410410
VS_VERSION_INFO VERSIONINFO
411-
FILEVERSION 4,11,2283,0
412-
PRODUCTVERSION 4,11,2283,0
411+
FILEVERSION 4,11,2284,0
412+
PRODUCTVERSION 4,11,2284,0
413413
FILEFLAGSMASK 0x3fL
414414
#ifdef _DEBUG
415415
FILEFLAGS 0x1L
@@ -427,13 +427,13 @@ BEGIN
427427
VALUE "Comments", "https://rufus.ie"
428428
VALUE "CompanyName", "Akeo Consulting"
429429
VALUE "FileDescription", "Rufus"
430-
VALUE "FileVersion", "4.11.2283"
430+
VALUE "FileVersion", "4.11.2284"
431431
VALUE "InternalName", "Rufus"
432432
VALUE "LegalCopyright", "� 2011-2025 Pete Batard (GPL v3)"
433433
VALUE "LegalTrademarks", "https://www.gnu.org/licenses/gpl-3.0.html"
434434
VALUE "OriginalFilename", "rufus-4.11.exe"
435435
VALUE "ProductName", "Rufus"
436-
VALUE "ProductVersion", "4.11.2283"
436+
VALUE "ProductVersion", "4.11.2284"
437437
END
438438
END
439439
BLOCK "VarFileInfo"

0 commit comments

Comments
 (0)