linux-kernel - Re: [PATCH 4/6] tpm: sanity check the log version before using it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZuRGQzirtUfih7sO@PC2K9PVX.TheFacebook.com>
Date: Fri, 13 Sep 2024 10:03:47 -0400
From: Gregory Price <gourry@...rry.net>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Ilias Apalodimas <ilias.apalodimas@...aro.org>,
	linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org,
	leitao@...ian.org, usamaarif642@...il.com,
	sathyanarayanan.kuppuswamy@...ux.intel.com
Subject: Re: [PATCH 4/6] tpm: sanity check the log version before using it

On Fri, Sep 13, 2024 at 03:47:03PM +0200, Ard Biesheuvel wrote:
> > > If we agree that this needs to go in btw, I think you should refactor
> > > it a bit. That function already defines an out: label, which unmaps
> > > memory. So you can rewrite the above as
> > >
> > > If(....) {
> > >     ret = -EINVAL;
> > >     efi.tpm_log = EFI_INVALID_TABLE_ADDR;
> > >    goto out;
> > > }
> > >
> >
> > Validating a table that was created by the EFI stub seems redundant.
> > If the version check needs to be tightened, please do so in
> > efi_retrieve_tcg2_eventlog() (in the stub).
> 
> ... and actually, this version is set by the EFI stub based on which
> flavor of the TCG protocols it found.
> 
> So i don't think we need this check to begin with.
> 
> If we need to detect corruption of these tables, I'd prefer to add a
> checksum or something like that. But I don't think we should bother.

Will drop, east enough.  Will send v2 later today.

~Gregory