Re: [PATCH v3 1/5] efi/libstub: Use correct event size when measuring data into the TPM

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, 8 Mar 2024 at 10:38, Ilias Apalodimas
<ilias.apalodimas@xxxxxxxxxx> wrote:
>
> Hi Ard
>
> On Fri, 8 Mar 2024 at 10:58, Ard Biesheuvel <ardb+git@xxxxxxxxxx> wrote:
> >
> > From: Ard Biesheuvel <ardb@xxxxxxxxxx>
> >
> > Our efi_tcg2_tagged_event is not defined in the EFI spec, but it is not
> > a local invention either: it was taken from the TCG PC Client spec,
> > where it is called TCG_PCClientTaggedEvent.
> >
> > This spec also contains some guidance on how to populate it, which
> > is not being followed closely at the moment; the event size should cover
> > the TCG_PCClientTaggedEvent and its payload only, but it currently
> > covers the preceding efi_tcg2_event too, and this may result in trailing
> > garbage being measured into the TPM.
>
> I think there's a confusion here and the current code we have is correct.
> The EFI TCG spec [0] says that the tdEFI_TCG2_EVENT size is:
> "Total size of the event including the Size component, the header and the
> Event data." which obviously contradicts the definition of the tagged
> event in the PC client spec.
> But given the fact that TCG_PCClientTaggedEvent has its own size field
> I think we should use what we already have.
>
>
> [0] https://trustedcomputinggroup.org/wp-content/uploads/EFI-Protocol-Specification-rev13-160330final.pdf
> page 33
>

Fair enough.

It is rather disappointing that the TCG2 specs contradict each other,
but a quick inspection of the EDK2 implementation shows that it
follows your interpretation.

For example, in Tcg2HashLogExtendEvent()
[SecurityPkg/Tcg/Tcg2Dxe/Tcg2Dxe.c], we have a check

if (Event->Size < Event->Header.HeaderSize + sizeof (UINT32)) {
  return EFI_INVALID_PARAMETER;
}

which ensures that the event size covers at least the EFI_TCG2_EVENT,
which obviously implies that 'size' is expected to include it.

So please disregard this series




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux