From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12B3CC433E0 for ; Wed, 17 Jun 2020 23:10:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EFE4821534 for ; Wed, 17 Jun 2020 23:10:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726845AbgFQXKH (ORCPT ); Wed, 17 Jun 2020 19:10:07 -0400 Received: from mga02.intel.com ([134.134.136.20]:18187 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726761AbgFQXKG (ORCPT ); Wed, 17 Jun 2020 19:10:06 -0400 IronPort-SDR: BOApvUG5IKHXyrRMBb+iw+O9cAOTcYnrDPkbBdXW+9lpNXNCTdKR7s6L50ZqA6SfLkVG3ER3fN QXNjm2WZaHzQ== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jun 2020 16:10:05 -0700 IronPort-SDR: Xh1ebDmI2ePs5KOp7NfFQgx3PcIZQSKlrBspT7+i6hmvSQnE4h2j8LGD17Foz1au+O+snVSTRH /DhIkrek56Xw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,523,1583222400"; d="scan'208";a="309638656" Received: from kleeve-mobl.ger.corp.intel.com (HELO localhost) ([10.252.50.166]) by fmsmga002.fm.intel.com with ESMTP; 17 Jun 2020 16:09:59 -0700 Date: Thu, 18 Jun 2020 02:09:58 +0300 From: Jarkko Sakkinen To: Ard Biesheuvel Cc: Tyler Hicks , Matthew Garrett , Peter Jones , Peter Huewe , Jason Gunthorpe , Petr Vandrovec , Nayna Jain , Thirupathaiah Annapureddy , linux-integrity , linux-efi , Linux Kernel Mailing List Subject: Re: [PATCH] tpm: Require that all digests are present in TCG_PCR_EVENT2 structures Message-ID: <20200617230958.GC62794@linux.intel.com> References: <20200615232504.1848159-1-tyhicks@linux.microsoft.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org On Tue, Jun 16, 2020 at 11:08:38AM +0200, Ard Biesheuvel wrote: > (cc Matthew and Peter) > > On Tue, 16 Jun 2020 at 01:28, Tyler Hicks wrote: > > > > Require that the TCG_PCR_EVENT2.digests.count value strictly matches the > > value of TCG_EfiSpecIdEvent.numberOfAlgorithms in the event field of the > > TCG_PCClientPCREvent event log header. Also require that > > TCG_EfiSpecIdEvent.numberOfAlgorithms is non-zero. > > > > The TCG PC Client Platform Firmware Profile Specification section 9.1 > > (Family "2.0", Level 00 Revision 1.04) states: > > > > For each Hash algorithm enumerated in the TCG_PCClientPCREvent entry, > > there SHALL be a corresponding digest in all TCG_PCR_EVENT2 structures. > > Note: This includes EV_NO_ACTION events which do not extend the PCR. > > > > Section 9.4.5.1 provides this description of > > TCG_EfiSpecIdEvent.numberOfAlgorithms: > > > > The number of Hash algorithms in the digestSizes field. This field MUST > > be set to a value of 0x01 or greater. > > > > Enforce these restrictions, as required by the above specification, in > > order to better identify and ignore invalid sequences of bytes at the > > end of an otherwise valid TPM2 event log. Firmware doesn't always have > > the means necessary to inform the kernel of the actual event log size so > > the kernel's event log parsing code should be stringent when parsing the > > event log for resiliency against firmware bugs. This is true, for > > example, when firmware passes the event log to the kernel via a reserved > > memory region described in device tree. > > > > When does this happen? Do we have code in mainline that does this? > > > Prior to this patch, a single bit set in the offset corresponding to > > either the TCG_PCR_EVENT2.eventType or TCG_PCR_EVENT2.eventSize fields, > > after the last valid event log entry, could confuse the parser into > > thinking that an additional entry is present in the event log. This > > patch raises the bar on how difficult it is for stale memory to confuse > > the kernel's event log parser but there's still a reliance on firmware > > to properly initialize the remainder of the memory region reserved for > > the event log as the parser cannot be expected to detect a stale but > > otherwise properly formatted firmware event log entry. > > > > Fixes: fd5c78694f3f ("tpm: fix handling of the TPM 2.0 event logs") > > Signed-off-by: Tyler Hicks > > --- > > I am all for stringent checks, but this could potentially break > measured boot on systems that are working fine today, right? There would not be any sane reason to implement a TPM chip like that. /Jarkko