Menu

Commit [521c58] default  Maximize  Restore  History

Fix security vulnerabilities rooted in tpm_if structure and g_tpm variable.

I'm a senior security researcher at National Security Research Institute of
South Korea.

The current implementation of tboot does not measure function pointers of
TPM devices because the tpm_if structure has mutable values such as a locality,
an algorithm type, and indexes.
Therefore, the attacker can change them to hijack control flow of tboot and
can manipulate the PCR values of TPM by extending known hashes.

This is severe security vulnerability because we do not trust PCRs anymore.

To fix the vulnerability, I divide the tpm_if structure into two parts,
a mutable part, and an immutable part. The mutable part, tpm_if structure, has
only the data for TPM. The immutable part, tpm_if_fp structure, has only the
function pointers, so it can be measured.
I also change the type of g_tpm variable from structure to integer for fixing
the security vulnerability.

Signed-off-by: Seunghun Han <kkamagui@...>
Reviewed-by: Ning Sun <ning.sun@...>

Ning Sun Ning Sun 2017-11-13

changed tboot/common/cmdline.c
changed tboot/common/integrity.c
changed tboot/common/loader.c
changed tboot/common/policy.c
changed tboot/common/tb_error.c
changed tboot/common/tboot.c
changed tboot/common/tpm.c
changed tboot/common/tpm_12.c
changed tboot/common/tpm_20.c
changed tboot/include/tpm.h
changed tboot/txt/acmod.c
changed tboot/txt/heap.c
changed tboot/txt/txt.c
tboot/common/cmdline.c Diff Switch to side-by-side view
Loading...
tboot/common/integrity.c Diff Switch to side-by-side view
Loading...
tboot/common/loader.c Diff Switch to side-by-side view
Loading...
tboot/common/policy.c Diff Switch to side-by-side view
Loading...
tboot/common/tb_error.c Diff Switch to side-by-side view
Loading...
tboot/common/tboot.c Diff Switch to side-by-side view
Loading...
tboot/common/tpm.c Diff Switch to side-by-side view
Loading...
tboot/common/tpm_12.c Diff Switch to side-by-side view
Loading...
tboot/common/tpm_20.c Diff Switch to side-by-side view
Loading...
tboot/include/tpm.h Diff Switch to side-by-side view
Loading...
tboot/txt/acmod.c Diff Switch to side-by-side view
Loading...
tboot/txt/heap.c Diff Switch to side-by-side view
Loading...
tboot/txt/txt.c Diff Switch to side-by-side view
Loading...