Multiple SMM memory corruption vulnerabilities in SMM module on Gigabyte device (SMRAM write).

EFI_STATUS SwSmiHandler(
        EFI_HANDLE DispatchHandle,
        const void *Context,
        EFI_SMM_SW_CONTEXT *CommBuffer,
        UINTN *CommBufferSize)
{
  UINTN SwSmiCpuIndex;
  UINT8 CommandPort;
  EFI_STATUS Status;
  UINT64 Data;
  void (*SMIFlashPreHandlerFunc)(UINT64, FUNC_BLOCK *);
  FUNC_BLOCK *FuncBlock;
  UINTN PreHandlerFuncIndex;
  UINT64 Rem0;
  UINT64 Rem1;
  void (*SMIFlashEndHandlerFunc)();
  UINTN Index;
  void (*SMIFlashPreUpdateFunc)();
  UINTN FlashPreUpdateFuncIndex;
  void (*SMIFlashPreHandlerFunc0)(UINT64, FUNC_BLOCK *);
  UINTN PostHandlerFuncIndex;
  UINT32 RbxRegister;
  UINT32 RcxRegister;

  RcxRegister = 0;
  RbxRegister = 0;
  if ( !CommBuffer )
    return 0;
  if ( !CommBufferSize )
    return 0;
  SwSmiCpuIndex = CommBuffer->SwSmiCpuIndex;
  CommandPort = CommBuffer->CommandPort;
  if ( CommBuffer->SwSmiCpuIndex == -1 )
    return 0;

  gEfiSmmCpuProtocol->ReadSaveState(
    gEfiSmmCpuProtocol,
    4,
    EFI_SMM_SAVE_STATE_REGISTER_RBX,
    CommBuffer->SwSmiCpuIndex,
    &RbxRegister);

  Status = gEfiSmmCpuProtocol->ReadSaveState(
             gEfiSmmCpuProtocol,
             4,
             EFI_SMM_SAVE_STATE_REGISTER_RCX,
             SwSmiCpuIndex,
             &RcxRegister);

  Data = RbxRegister;
  SMIFlashHandlerFunc0 = gSMIFlashHandlerFuncs[0];

  // FuncBlock is attacker controlled and unchecked pointer
  FuncBlock = (RbxRegister + (RcxRegister << 32));

  PreHandlerFuncIndex = 0;
  // SMIFlashPreHandlerFuncs is empty
  while...

  Rem0 = CommandPort - 32;
  switch ( CommandPort )
  {
    case SMIFLASH_ENABLE_FLASH:
      SMIFlashPreUpdateFunc = gSMIFlashPreUpdateFuncs[0];
      FlashPreUpdateFuncIndex = 0;
      while ( SMIFlashPreUpdateFunc )
      {
        SMIFlashPreUpdateFunc();
        SMIFlashPreUpdateFunc = *(&gSMIFlashPreUpdateFuncs[1] + FlashPreUpdateFuncIndex++);
      }
      (gAmiSmmFlashProtocol->DeviceWriteEnable)(Rem0);
      break;

    case SMIFLASH_READ_FLASH:
      // vulnerable function
      ReadFlash(FuncBlock);
      break;

    case SMIFLASH_ERASE_FLASH:
      // vulnerable function
      EraseFlash(FuncBlock);
      break;

    case SMIFLASH_WRITE_FLASH:
      // vulnerable function
      WriteFlash(FuncBlock);
      break;

    default:
      Rem1 = CommandPort - SMIFLASH_DISABLE_FLASH;
      if ( CommandPort == SMIFLASH_DISABLE_FLASH )
      {
        SMIFlashEndHandlerFunc = gSMIFlashEndHandlerFuncs[0];
        Index = 0;
        while ( SMIFlashEndHandlerFunc )
        {
          SMIFlashEndHandlerFunc();
          SMIFlashEndHandlerFunc = *(&gSMIFlashEndHandlerFuncs[1] + Index++);
        }
        gAmiSmmFlashProtocol->DeviceWriteDisable();
      }
      else if ( CommandPort == SMIFLASH_GET_FLASH_INFO )
      {
        // vulnerable function
        GetFlashInfo((INFO_BLOCK *)FuncBlock);
      }
      break;
  }

  // gSMIFlashHandlerFuncs is empty
  SMIFlashHandlerFunc1 = gSMIFlashHandlerFuncs[1];
  PostHandlerFuncIndex = 0;
  while...
  return Status;
}

EFI_STATUS ReadFlash(FUNC_BLOCK *FuncBlock)
{
  EFI_STATUS Status;

  // SMRAM write via Read API function as FuncBlock->BufAddr nested pointer is not checked
  Status = (gAmiSmmFlashProtocol->Read)(FuncBlock->BlockAddr - 0x500000, FuncBlock->BlockSize, FuncBlock->BufAddr);

  // SMRAM write
  FuncBlock->ErrorCode = EFI_ERROR(Status) != 0;
  return Status;
}

EFI_STATUS EraseFlash(FUNC_BLOCK *FuncBlock)
{
  EFI_STATUS Status;
  UINT64 FlashAddress;

  FlashAddress = FuncBlock->BlockAddr - g500000h;
  LODWORD(FlashAddress) = FlashAddress & 0xFFFFF000;
  Status = (gAmiSmmFlashProtocol->Erase)(FlashAddress, 0x1000);

  // SMRAM write
  FuncBlock->ErrorCode = EFI_ERROR(Status) != 0;
  return Status;
}

EFI_STATUS WriteFlash(FUNC_BLOCK *FuncBlock)
{
  EFI_STATUS Status; // rax

  // SMRAM read via Write API function as FuncBlock->BufAddr nested pointer is not checked,
  // allowing an attacker to write SMRAM content to flash and then read it from there
  Status = (gAmiSmmFlashProtocol->Write)(FuncBlock->BlockAddr - g500000h, FuncBlock->BlockSize, FuncBlock->BufAddr);

  // SMRAM write
  FuncBlock->ErrorCode = EFI_ERROR(Status) != 0;
  return Status;
}

EFI_STATUS GetFlashInfo(INFO_BLOCK *InfoBlock)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS NUMPAD "+" TO EXPAND]

  __outbyte(0x80, 0x25);
  Size = InfoBlock->Length - 0x10;
  InfoBlock->Version = 0xB;                     // SMRAM write
  Block = &InfoBlock->Blocks;
  InfoBlock->Implemented = 0;                   // SMRAM write
  InfoBlock->BiosRomSize = 0;                   // SMRAM write
  *&InfoBlock->BaseBlockSize = 0;               // SMRAM write
  InfoBlock->TotalBlocks = 0x500;               // SMRAM write
  if ( Size < 0x2D00 )
  {
    InfoBlock->Implemented = 1;                 // SMRAM write
    return 0;
  }
  Status = gSmst->SmmAllocatePool(EfiRuntimeServicesData, 2 * gNumberOfRomLayout, &StartBlock);
  if ( !EFI_ERROR(Status) )
  {
    Status = gSmst->SmmAllocatePool(EfiRuntimeServicesData, 2 * gNumberOfRomLayout, &EndBlock);
    if ( !EFI_ERROR(Status) )
    {
      NumberOfRomLayout = gNumberOfRomLayout;
      Index = 0;
      if ( gNumberOfRomLayout )
      {
        BlockIndex = 0;
        do
        {
          ++Index;
          Res = RomLayout[BlockIndex].Offset >> 12;
          StartBlock[BlockIndex] = Res;
          EndBlock[BlockIndex] = Res + (RomLayout[BlockIndex].Size >> 12) - 1;
          NumberOfRomLayout = gNumberOfRomLayout;
          BlockIndex = Index;
        }
        while ( Index < gNumberOfRomLayout );
      }
      Start = StartBlock;
      End = EndBlock;
      NcbType = gNumberOfNcb + 0x7F;
      for ( i = 0; i < 0x500; ++i )
      {
        Block->BlockSize = 4096;                // SMRAM write
        Element = 0;
        Block->StartAddress = i << 12;          // SMRAM write
        if ( NumberOfRomLayout )
        {
          ElementIndex = 0;
          while ( i < Start[ElementIndex] || i > End[ElementIndex] )
          {
            ElementIndex = ++Element;
            if ( Element >= NumberOfRomLayout )
              goto _Next;
          }
          Block->Type = RomLayout[Element].Type;// SMRAM write
        }
        ...
    }
  }
  return Status;
}