|
| 1 | +From 98599df9392a346216c5a059b8d35271286100bb Mon Sep 17 00:00:00 2001 |
| 2 | +From: Juergen Repp <juergen_repp@web.de> |
| 3 | +Date: Tue, 5 Mar 2024 22:11:38 +0100 |
| 4 | +Subject: [PATCH] tpm2_checkquote: Add comparison of pcr selection. |
| 5 | + |
| 6 | +The pcr selection which is passed with the --pcr parameter it not |
| 7 | +compared with the attest. So it's possible to fake a valid |
| 8 | +attestation. |
| 9 | + |
| 10 | +Fixes: CVE-2024-29039 |
| 11 | + |
| 12 | +Signed-off-by: Juergen Repp <juergen_repp@web.de> |
| 13 | +Signed-off-by: Andreas Fuchs <andreas.fuchs@infineon.com> |
| 14 | + |
| 15 | +--- |
| 16 | + tools/misc/tpm2_checkquote.c | 41 +++++++++++++++++++++++++++++++++++- |
| 17 | + 1 file changed, 40 insertions(+), 1 deletion(-) |
| 18 | + |
| 19 | +diff --git a/tools/misc/tpm2_checkquote.c b/tools/misc/tpm2_checkquote.c |
| 20 | +index 9225b25..d682f48 100644 |
| 21 | +--- a/tools/misc/tpm2_checkquote.c |
| 22 | ++++ b/tools/misc/tpm2_checkquote.c |
| 23 | +@@ -48,6 +48,37 @@ static tpm2_verifysig_ctx ctx = { |
| 24 | + .pcr_hash = TPM2B_TYPE_INIT(TPM2B_DIGEST, buffer), |
| 25 | + }; |
| 26 | + |
| 27 | ++static bool compare_pcr_selection(TPML_PCR_SELECTION *attest_sel, TPML_PCR_SELECTION *pcr_sel) { |
| 28 | ++ if (attest_sel->count != pcr_sel->count) { |
| 29 | ++ LOG_ERR("Selection sizes do not match."); |
| 30 | ++ return false; |
| 31 | ++ } |
| 32 | ++ for (uint32_t i = 0; i < attest_sel->count; i++) { |
| 33 | ++ for (uint32_t j = 0; j < pcr_sel->count; j++) { |
| 34 | ++ if (attest_sel->pcrSelections[i].hash == |
| 35 | ++ pcr_sel->pcrSelections[j].hash) { |
| 36 | ++ if (attest_sel->pcrSelections[i].sizeofSelect != |
| 37 | ++ pcr_sel->pcrSelections[j].sizeofSelect) { |
| 38 | ++ LOG_ERR("Bitmask size does not match"); |
| 39 | ++ return false; |
| 40 | ++ } |
| 41 | ++ if (memcmp(&attest_sel->pcrSelections[i].pcrSelect[0], |
| 42 | ++ &pcr_sel->pcrSelections[j].pcrSelect[0], |
| 43 | ++ attest_sel->pcrSelections[i].sizeofSelect) != 0) { |
| 44 | ++ LOG_ERR("Selection bitmasks do not match"); |
| 45 | ++ return false; |
| 46 | ++ } |
| 47 | ++ break; |
| 48 | ++ } |
| 49 | ++ if (j == pcr_sel->count - 1) { |
| 50 | ++ LOG_ERR("Hash selections to not match."); |
| 51 | ++ return false; |
| 52 | ++ } |
| 53 | ++ } |
| 54 | ++ } |
| 55 | ++ return true; |
| 56 | ++} |
| 57 | ++ |
| 58 | + static bool verify_signature() { |
| 59 | + |
| 60 | + bool result = false; |
| 61 | +@@ -212,7 +243,7 @@ static tool_rc init(void) { |
| 62 | + } |
| 63 | + |
| 64 | + TPM2B_ATTEST *msg = NULL; |
| 65 | +- TPML_PCR_SELECTION pcr_select; |
| 66 | ++ TPML_PCR_SELECTION pcr_select = { 0 }; |
| 67 | + tpm2_pcrs * pcrs; |
| 68 | + tool_rc return_value = tool_rc_general_error; |
| 69 | + |
| 70 | +@@ -279,6 +310,14 @@ static tool_rc init(void) { |
| 71 | + goto err; |
| 72 | + } |
| 73 | + |
| 74 | ++ if (ctx.flags.pcr) { |
| 75 | ++ if (!compare_pcr_selection(&ctx.attest.attested.quote.pcrSelect, |
| 76 | ++ &pcr_select)) { |
| 77 | ++ LOG_ERR("PCR selection does not match PCR slection from attest!"); |
| 78 | ++ goto err; |
| 79 | ++ } |
| 80 | ++ } |
| 81 | ++ |
| 82 | + // Figure out the digest for this message |
| 83 | + bool res = tpm2_openssl_hash_compute_data(ctx.halg, msg->attestationData, |
| 84 | + msg->size, &ctx.msg_hash); |
0 commit comments