On August 31, 2021 6:21 PM, Gerd Hoffmann wrote: > On Tue, Aug 31, 2021 at 06:17:29AM +0000, Xu, Min M wrote: > > On August 31, 2021 1:13 PM, Gerd Hoffmann wrote: > > > Hi, > > > > > > > > From a security point of view I don't think it is a good idea to > > > > > hard code any assumptions about the layout of the vars volume. > > > > Do you mean I cannot assume the layout of VarStore? > > > > At least in Ovmf the VarStore.fdf.inc defines the layout of > > > > VarStore like > > > below. > > > > > > What prevents an attacker from creating a varstore with a different > > > layout? > > > Place the variables at the end of the file, which isn't measured > > > (because you assume it is the spare part), then being able to change > > > variables without the guest noticing? > > If the VarStore does not follow the layout defined in > > VarStore.fdf.inc, do you mean the current Variable mechanism still > > works? From the code of InitNonVolatileVariableStore(), the first variable > > is > right after the VarStoreHeader. > > See GetStartPointer(). > > I didn't fully investigate what kind of attacks one can do. I'm pretty sure > simply > making the variable store larger and the spare smaller works, so parts of the > variable store are outside the area you are measuring. Not fully sure > whenever > one can actually reorder the sections to move the varstore completely into the > unmeasured area. Or play out other attacks with the same effect, like > bloating > some header struct. > > Simply measuring everything (including the spare) will stop all that. > Changes wouldn't go unnoticed, period. No ifs and buts. So I'm wondering why > you not doing that? Performance? Wouldn't be the first time a performance > optimization pokes a hole into a security concept ... > The measurement value of the CFV (provisioned configuration data) is extended to RTMR registers (similar to TPM PCRs). At the same time it is recorded in the TD Event log. These information will be used by the Attestation server (This is the so-called Attestation). In other words there is a known *good* CFV measurement value. Any changes to the CFV, for example the layout, the order of the variables, the content of the variables will produce a *bad* CFV measurement. Then in the later Attestation phase those changes will be detected.
Thanks! Min -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#80047): https://edk2.groups.io/g/devel/message/80047 Mute This Topic: https://groups.io/mt/85242567/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
