[edk2-devel] [PATCH v5 6/9] SecurityPkg/Tcg2Pei: Use Migrated FV Info Hob for calculating hash (CVE-2019-11098)
Wang, Jian J
jian.j.wang at intel.com
Mon Jul 13 07:09:23 UTC 2020
Reviewed-by: Jian J Wang <jian.j.wang at intel.com>
Regards,
Jian
> -----Original Message-----
> From: Jiang, Guomin <guomin.jiang at intel.com>
> Sent: Thursday, July 09, 2020 9:57 AM
> To: devel at edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao at intel.com>; Wang, Jian J <jian.j.wang at intel.com>;
> Zhang, Chao B <chao.b.zhang at intel.com>; Zhang, Qi1 <qi1.zhang at intel.com>;
> Kumar, Rahul1 <rahul1.kumar at intel.com>
> Subject: [PATCH v5 6/9] SecurityPkg/Tcg2Pei: Use Migrated FV Info Hob for
> calculating hash (CVE-2019-11098)
>
> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614
>
> When we allocate pool to save rebased the PEIMs, the address will change
> randomly, therefore the hash will change and result PCR0 change as well.
> To avoid this, we save the raw PEIMs and use it to calculate hash.
> The Tcg2Pei calculate the hash and it use the Migrated FV Info.
>
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Jian J Wang <jian.j.wang at intel.com>
> Cc: Chao Zhang <chao.b.zhang at intel.com>
> Cc: Qi Zhang <qi1.zhang at intel.com>
> Cc: Rahul Kumar <rahul1.kumar at intel.com>
> Signed-off-by: Guomin Jiang <guomin.jiang at intel.com>
> ---
> SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf | 1 +
> SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c | 31 ++++++++++++++++++++++++++---
> 2 files changed, 29 insertions(+), 3 deletions(-)
>
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> index 3d361e8859e7..367df21eedaf 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
> @@ -63,6 +63,7 @@ [Guids]
> gTcgEvent2EntryHobGuid ## PRODUCES ##
> HOB
> gEfiTpmDeviceInstanceNoneGuid ##
> SOMETIMES_PRODUCES ## GUID # TPM device identifier
> gEfiTpmDeviceInstanceTpm12Guid ##
> SOMETIMES_PRODUCES ## GUID # TPM device identifier
> + gEdkiiMigratedFvInfoGuid ##
> SOMETIMES_CONSUMES ## HOB
>
> [Ppis]
> gEfiPeiFirmwareVolumeInfoPpiGuid ##
> SOMETIMES_CONSUMES ## NOTIFY
> diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> index 4852d8690617..651a60c1f0e2 100644
> --- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> +++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
> @@ -21,6 +21,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #include <Guid/TcgEventHob.h>
> #include <Guid/MeasuredFvHob.h>
> #include <Guid/TpmInstance.h>
> +#include <Guid/MigratedFvInfo.h>
>
> #include <Library/DebugLib.h>
> #include <Library/BaseMemoryLib.h>
> @@ -536,6 +537,10 @@ MeasureFvImage (
> EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI
> *PrehashedFvPpi;
> HASH_INFO *PreHashInfo;
> UINT32 HashAlgoMask;
> + EFI_PHYSICAL_ADDRESS FvOrgBase;
> + EFI_PHYSICAL_ADDRESS FvDataBase;
> + EFI_PEI_HOB_POINTERS Hob;
> + EDKII_MIGRATED_FV_INFO *MigratedFvInfo;
>
> //
> // Check Excluded FV list
> @@ -621,6 +626,26 @@ MeasureFvImage (
> Instance++;
> } while (!EFI_ERROR(Status));
>
> + //
> + // Search the matched migration FV info
> + //
> + FvOrgBase = FvBase;
> + FvDataBase = FvBase;
> + Hob.Raw = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid);
> + while (Hob.Raw != NULL) {
> + MigratedFvInfo = GET_GUID_HOB_DATA (Hob);
> + if ((MigratedFvInfo->FvNewBase == (UINT32) FvBase) && (MigratedFvInfo-
> >FvLength == (UINT32) FvLength)) {
> + //
> + // Found the migrated FV info
> + //
> + FvOrgBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo-
> >FvOrgBase;
> + FvDataBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo-
> >FvDataBase;
> + break;
> + }
> + Hob.Raw = GET_NEXT_HOB (Hob);
> + Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw);
> + }
> +
> //
> // Init the log event for FV measurement
> //
> @@ -631,13 +656,13 @@ MeasureFvImage (
> if (FvName != NULL) {
> AsciiSPrint ((CHAR8 *)FvBlob2.BlobDescription,
> sizeof(FvBlob2.BlobDescription), "Fv(%g)", FvName);
> }
> - FvBlob2.BlobBase = FvBase;
> + FvBlob2.BlobBase = FvOrgBase;
> FvBlob2.BlobLength = FvLength;
> TcgEventHdr.EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB2;
> TcgEventHdr.EventSize = sizeof (FvBlob2);
> EventData = &FvBlob2;
> } else {
> - FvBlob.BlobBase = FvBase;
> + FvBlob.BlobBase = FvOrgBase;
> FvBlob.BlobLength = FvLength;
> TcgEventHdr.PCRIndex = 0;
> TcgEventHdr.EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB;
> @@ -672,7 +697,7 @@ MeasureFvImage (
> //
> Status = HashLogExtendEvent (
> 0,
> - (UINT8*) (UINTN) FvBase, // HashData
> + (UINT8*) (UINTN) FvDataBase, // HashData
> (UINTN) FvLength, // HashDataLen
> &TcgEventHdr, // EventHdr
> EventData // EventData
> --
> 2.25.1.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#62397): https://edk2.groups.io/g/devel/message/62397
Mute This Topic: https://groups.io/mt/75390180/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list