From 0a95bc6166ab6f63b68423d28e4bc9bddfdab781 Mon Sep 17 00:00:00 2001
From: ShenYage <shenyage1@huawei.com>
Date: Fri, 28 Feb 2025 16:04:22 +0800
Subject: [PATCH 1/2] NetworkPkg: TcpDxe: SECURITY PATCH CVE-2023-45236 Relared
 Patch

BUG: Tianocore's EDK2 TCP implementation generates ISNs using fixed
increments from a fixed base value and thus is uceptible to TCP session injection
and session hijack attacks.

This commit is a patch for CVE-2023-45236. Generates ISNs using RngLib to get a high-quality random number.

Signed-off-by: ShenYage <shenyage1@huawei.com>
---
 NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
 NetworkPkg/TcpDxe/TcpMain.h  | 1 +
 NetworkPkg/TcpDxe/TcpMisc.c  | 9 ++++++++-
 NetworkPkg/TcpDxe/TcpTimer.c | 7 ++++++-
 4 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf b/NetworkPkg/TcpDxe/TcpDxe.inf
index c0acbdc..99c0936 100644
--- a/NetworkPkg/TcpDxe/TcpDxe.inf
+++ b/NetworkPkg/TcpDxe/TcpDxe.inf
@@ -67,6 +67,7 @@
   DpcLib
   NetLib
   IpIoLib
+  RngLib
 
 
 [Protocols]
diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
index 35f12a1..10f7671 100644
--- a/NetworkPkg/TcpDxe/TcpMain.h
+++ b/NetworkPkg/TcpDxe/TcpMain.h
@@ -16,6 +16,7 @@
 #include <Library/IpIoLib.h>
 #include <Library/DevicePathLib.h>
 #include <Library/PrintLib.h>
+#include <Library/RngLib.h>
 
 #include "Socket.h"
 #include "TcpProto.h"
diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
index 73ed33d..15d9d5a 100644
--- a/NetworkPkg/TcpDxe/TcpMisc.c
+++ b/NetworkPkg/TcpDxe/TcpMisc.c
@@ -522,7 +522,14 @@ TcpGetIss (
   VOID
   )
 {
-  mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+  UINT32  RandomVal;
+
+  if (GetRandomNumber32(&RandomVal)) {
+    mTcpGlobalIss += RandomVal;
+  } else {
+    mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+  }
+
   return mTcpGlobalIss;
 }
 
diff --git a/NetworkPkg/TcpDxe/TcpTimer.c b/NetworkPkg/TcpDxe/TcpTimer.c
index 106d947..47b8d3e 100644
--- a/NetworkPkg/TcpDxe/TcpTimer.c
+++ b/NetworkPkg/TcpDxe/TcpTimer.c
@@ -495,9 +495,14 @@ TcpTickingDpc (
   LIST_ENTRY      *Next;
   TCP_CB          *Tcb;
   INT16           Index;
+  UINT32          RandomVal;
 
   mTcpTick++;
-  mTcpGlobalIss += TCP_ISS_INCREMENT_2;
+  if (GetRandomNumber32(&RandomVal)) {
+    mTcpGlobalIss += RandomVal;
+  } else {
+    mTcpGlobalIss += TCP_ISS_INCREMENT_2;
+  }
 
   //
   // Don't use LIST_FOR_EACH, which isn't delete safe.
-- 
2.33.0

