Verify signature before verifying sbat levels

Verifying the validity of a files signature can protect from an attacker creating a file that exploits a potential issue in the sbat validation. If the signature is not checked first, an attacker can just create a file with a valid .sbat section and can still attack the signature validation. Signed-off-by: Jan Setje-Eilers <[email protected]>
rhboot · Jun 27, 2023 · 61e9894 · 61e9894
1 parent 569270d
commit 61e9894
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/shim.c b/shim.c
@@ -753,11 +753,11 @@ verify_buffer (char *data, int datasize,
 {
 	EFI_STATUS efi_status;
 
-	efi_status = verify_buffer_sbat(data, datasize, context);
+	efi_status = verify_buffer_authenticode(data, datasize, context, sha256hash, sha1hash);
 	if (EFI_ERROR(efi_status))
 		return efi_status;
 
-	return verify_buffer_authenticode(data, datasize, context, sha256hash, sha1hash);
+	return verify_buffer_sbat(data, datasize, context);
 }
 
 static int