Version Check for capsule update seems error (Bugzilla Bug 367)

[tianocore-issues]

This issue was created automatically with bugzilla2github

Bugzilla Bug 367

Date: 2017-02-07T00:51:04+00:00
From: Wang Cloud <>
To: @jyao1
CC: @jyao1

Last updated: 2017-02-09T00:45:13+00:00

[tianocore-issues]

Comment 1390

Date: 2017-02-07 00:51:04 +0000
From: Wang Cloud <>

• Industry Specification: ---
• Target OS: ---
• Bugzilla Assignee(s): @jyao1

In CapsuleAuthenticateSystemFirmware of SignedCapsulePkg\Library\EdkiiSystemCapsuleLib\EdkiiSystemCapsuleLib.c, the following logic seems error

if (ForceVersionMatch) {
if (CurrentImageFmpInfo->Version != ImageFmpInfo->Version) {
*LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
DEBUG((DEBUG_INFO, "ForceVersionMatch check - fail\n"));
return EFI_SECURITY_VIOLATION;
}
} else {
if (CurrentImageFmpInfo->Version < ImageFmpInfo->LowestSupportedImageVersion) {
*LastAttemptStatus = LAST_ATTEMPT_STATUS_ERROR_INCORRECT_VERSION;
DEBUG((DEBUG_INFO, "LowestSupportedImageVersion check - fail\n"));
return EFI_SECURITY_VIOLATION;
}
}

I think it should be CurrentImageFmpInfo->LowestSupportedImageVersion > ImageFmpInfo->Version

The version check requires that the Version in capsule image must be greater than or equal to the LowestSupportedImageVersion in the current firmware. If the version in capsule image is lower than that in the current firmware, this capsule should be dropped.

[tianocore-issues]

Comment 1391

Date: 2017-02-07 01:02:11 +0000
From: @jyao1

Bug confirmed.

[tianocore-issues]

Comment 1411

Date: 2017-02-09 00:42:34 +0000
From: @jyao1

Fixed in 41ccec5

[tianocore-issues]

Comment 1412

Date: 2017-02-09 00:45:13 +0000
From: Wang Cloud <>

fixed in latest trunk