SecurityPkg/Tcg2Pei: Use Migrated FV Info Hob for calculating hash (CVE-2019-11098)

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614

When we allocate pool to save rebased the PEIMs, the address will change
randomly, therefore the hash will change and result PCR0 change as well.
To avoid this, we save the raw PEIMs and use it to calculate hash.
The Tcg2Pei calculate the hash and it use the Migrated FV Info.

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Qi Zhang <qi1.zhang@intel.com>
Cc: Rahul Kumar <rahul1.kumar@intel.com>
Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>
Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
Reviewed-by: Qi Zhang <qi1.zhang@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>

diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
index 71695df3d8652b2700f8ae6e85385466422529a6..246968bb7f8d08b28462b3c1821b9f80d0f9efee 100644 (file)
--- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
+++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c
@@ -22,6 +22,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Guid/TcgEventHob.h>\r
 #include <Guid/MeasuredFvHob.h>\r
 #include <Guid/TpmInstance.h>\r
+#include <Guid/MigratedFvInfo.h>\r
 \r
 #include <Library/DebugLib.h>\r
 #include <Library/BaseMemoryLib.h>\r
@@ -593,6 +594,10 @@ MeasureFvImage (
   EDKII_PEI_FIRMWARE_VOLUME_INFO_PREHASHED_FV_PPI       *PrehashedFvPpi;\r
   HASH_INFO                                             *PreHashInfo;\r
   UINT32                                                HashAlgoMask;\r
+  EFI_PHYSICAL_ADDRESS                                  FvOrgBase;\r
+  EFI_PHYSICAL_ADDRESS                                  FvDataBase;\r
+  EFI_PEI_HOB_POINTERS                                  Hob;\r
+  EDKII_MIGRATED_FV_INFO                                *MigratedFvInfo;\r
 \r
   //\r
   // Check Excluded FV list\r
@@ -678,6 +683,26 @@ MeasureFvImage (
     Instance++;\r
   } while (!EFI_ERROR(Status));\r
 \r
+  //\r
+  // Search the matched migration FV info\r
+  //\r
+  FvOrgBase  = FvBase;\r
+  FvDataBase = FvBase;\r
+  Hob.Raw  = GetFirstGuidHob (&gEdkiiMigratedFvInfoGuid);\r
+  while (Hob.Raw != NULL) {\r
+    MigratedFvInfo = GET_GUID_HOB_DATA (Hob);\r
+    if ((MigratedFvInfo->FvNewBase == (UINT32) FvBase) && (MigratedFvInfo->FvLength == (UINT32) FvLength)) {\r
+      //\r
+      // Found the migrated FV info\r
+      //\r
+      FvOrgBase  = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvOrgBase;\r
+      FvDataBase = (EFI_PHYSICAL_ADDRESS) (UINTN) MigratedFvInfo->FvDataBase;\r
+      break;\r
+    }\r
+    Hob.Raw = GET_NEXT_HOB (Hob);\r
+    Hob.Raw = GetNextGuidHob (&gEdkiiMigratedFvInfoGuid, Hob.Raw);\r
+  }\r
+\r
   //\r
   // Init the log event for FV measurement\r
   //\r
@@ -688,14 +713,14 @@ MeasureFvImage (
     if (FvName != NULL) {\r
       AsciiSPrint ((CHAR8 *)FvBlob2.BlobDescription, sizeof(FvBlob2.BlobDescription), "Fv(%g)", FvName);\r
     }\r
-    FvBlob2.BlobBase      = FvBase;\r
+    FvBlob2.BlobBase      = FvOrgBase;\r
     FvBlob2.BlobLength    = FvLength;\r
     TcgEventHdr.PCRIndex  = 0;\r
     TcgEventHdr.EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB2;\r
     TcgEventHdr.EventSize = sizeof (FvBlob2);\r
     EventData             = &FvBlob2;\r
   } else {\r
-    FvBlob.BlobBase       = FvBase;\r
+    FvBlob.BlobBase       = FvOrgBase;\r
     FvBlob.BlobLength     = FvLength;\r
     TcgEventHdr.PCRIndex  = 0;\r
     TcgEventHdr.EventType = EV_EFI_PLATFORM_FIRMWARE_BLOB;\r
@@ -725,7 +750,7 @@ MeasureFvImage (
     Status = HashLogExtendEvent (\r
                &mEdkiiTcgPpi,\r
                0,\r
-               (UINT8*) (UINTN) FvBase, // HashData\r
+               (UINT8*) (UINTN) FvDataBase, // HashData\r
                (UINTN) FvLength,        // HashDataLen\r
                &TcgEventHdr,            // EventHdr\r
                EventData                // EventData\r

diff --git a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
index f64b29f1ae4caec70ca306322e896ad7fd8dc659..06c26a2904b8020d716b438413ff01661085c63a 100644 (file)
--- a/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
+++ b/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf
@@ -63,6 +63,7 @@
   gTcgEvent2EntryHobGuid                                               ## PRODUCES               ## HOB\r
   gEfiTpmDeviceInstanceNoneGuid                                        ## SOMETIMES_PRODUCES     ## GUID       # TPM device identifier\r
   gEfiTpmDeviceInstanceTpm12Guid                                       ## SOMETIMES_PRODUCES     ## GUID       # TPM device identifier\r
+  gEdkiiMigratedFvInfoGuid                                             ## SOMETIMES_CONSUMES     ## HOB\r
 \r
 [Ppis]\r
   gEfiPeiFirmwareVolumeInfoPpiGuid                                     ## SOMETIMES_CONSUMES     ## NOTIFY\r