Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP2:Update
ovmf
ovmf-bsc1188371-SecurityPkg-Tcg2Pei-Use-Migrate...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File ovmf-bsc1188371-SecurityPkg-Tcg2Pei-Use-Migrated-FV-Info-Hob-for-cal.patch of Package ovmf
From 012809cdca4b876e675cbd181fee213133858a5e Mon Sep 17 00:00:00 2001 From: Guomin Jiang <guomin.jiang@intel.com> Date: Mon, 29 Jun 2020 14:50:21 +0800 Subject: [PATCH 6/9] SecurityPkg/Tcg2Pei: Use Migrated FV Info Hob for calculating hash (CVE-2019-11098) REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614 When we allocate pool to save rebased the PEIMs, the address will change randomly, therefore the hash will change and result PCR0 change as well. To avoid this, we save the raw PEIMs and use it to calculate hash. The Tcg2Pei calculate the hash and it use the Migrated FV Info. Joey Lee: Modified for do not backport "0286fe8176 SecurityPkg/Tcg2Pei: Add TCG PFP 105 support." because edk2-stable201911 doesn't support TCG PFP 105. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Qi Zhang <qi1.zhang@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com> Reviewed-by: Jian J Wang <jian.j.wang@intel.com> Reviewed-by: Qi Zhang <qi1.zhang@intel.com> Reviewed-by: Liming Gao <liming.gao@intel.com> --- SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c | 31 ++++++++++++++++++++++++++--- SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 1 + 2 files changed, 29 insertions(+), 3 deletions(-) Index: edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c =================================================================== --- edk2-edk2-stable201911.orig/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c +++ edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c @@ -21,6 +21,7 @@ SPDX-License-Identifier: BSD-2-Clause-Pa #include <Guid/TcgEventHob.h> #include <Guid/MeasuredFvHob.h> #include <Guid/TpmInstance.h> +#include <Guid/MigratedFvInfo.h> #include <Library/DebugLib.h> #include <Library/BaseMemoryLib.h> @@ -478,6 +479,10 @@ MeasureFvImage ( EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI *PrehashedFvPpi; HASH_INFO *PreHashInfo; UINT32 HashAlgoMask; + EFI_PHYSICAL_ADDRESS FvOrgBase; + EFI_PHYSICAL_ADDRESS FvDataBase; + EFI_PEI_HOB_POINTERS Hob; + EDKII_MIGRATED_FV_INFO *MigratedFvInfo; // // Check Excluded FV list @@ -564,9 +569,29 @@ MeasureFvImage ( } while (!EFI_ERROR(Status)); // + // Search the matched migration FV info + // + FvOrgBase = FvBase; + FvDataBase = FvBase; + Hob.Raw = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid); + while (Hob.Raw != NULL) { + MigratedFvInfo = GET_GUID_HOB_DATA (Hob); + if ((MigratedFvInfo->FvNewBase == (UINT32) FvBase) && (MigratedFvInfo->FvLength == (UINT32) FvLength)) { + // + // Found the migrated FV info + // + FvOrgBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvOrgBase; + FvDataBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvDataBase; + break; + } + Hob.Raw = GET_NEXT_HOB (Hob); + Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw); + } + + // // Init the log event for FV measurement // - FvBlob.BlobBase = FvBase; + FvBlob.BlobBase = FvOrgBase; FvBlob.BlobLength = FvLength; TcgEventHdr.PCRIndex = 0; TcgEventHdr.EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB; @@ -599,7 +624,7 @@ MeasureFvImage ( // Status = HashLogExtendEvent ( 0, - (UINT8*) (UINTN) FvBlob.BlobBase, + (UINT8*) (UINTN) FvDataBase, // HashData (UINTN) FvBlob.BlobLength, &TcgEventHdr, (UINT8*) &FvBlob Index: edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf =================================================================== --- edk2-edk2-stable201911.orig/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf +++ edk2-edk2-stable201911/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf @@ -62,6 +62,7 @@ gTcgEvent2EntryHobGuid ## PRODUCES ## HOB gEfiTpmDeviceInstanceNoneGuid ## SOMETIMES_PRODUCES ## GUID # TPM device identifier gEfiTpmDeviceInstanceTpm12Guid ## SOMETIMES_PRODUCES ## GUID # TPM device identifier + gEdkiiMigratedFvInfoGuid ## SOMETIMES_CONSUMES ## HOB [Ppis] gEfiPeiFirmwareVolumeInfoPpiGuid ## SOMETIMES_CONSUMES ## NOTIFY
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor