Re: [edk2-devel] [PATCH v7 05/10] MdeModulePkg/Core: Create Migrated FV Info Hob for calculating hash (CVE-2019-11098)

["Laszlo Ersek" <lersek@redhat.com>]

On 07/22/20 10:36, Guomin Jiang wrote:
> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1614
> 
> When we allocate pool to save the rebased PEIMs, the address will change
> randomly, therefore the hash will change and result PCR0 change as well.
> To avoid this, we save the raw PEIMs and use it to calculate hash.
> 
> The MigratedFvInfo HOB will never produce when
> PcdMigrateTemporaryRamFirmwareVolumes is FALSE, because the PCD control
> the total feature.
> 
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Dandan Bi <dandan.bi@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Debkumar De <debkumar.de@intel.com>
> Cc: Harry Han <harry.han@intel.com>
> Cc: Catharine West <catharine.west@intel.com>
> Signed-off-by: Guomin Jiang <guomin.jiang@intel.com>
> Acked-by: Laszlo Ersek <lersek@redhat.com>
> Reviewed-by: Jian J Wang <jian.j.wang@intel.com>
> ---
>  MdeModulePkg/MdeModulePkg.dec                 |  3 ++
>  MdeModulePkg/Core/Pei/PeiMain.inf             |  1 +
>  MdeModulePkg/Core/Pei/PeiMain.h               |  1 +
>  MdeModulePkg/Include/Guid/MigratedFvInfo.h    | 22 +++++++++++++++
>  MdeModulePkg/Core/Pei/Dispatcher/Dispatcher.c | 28 +++++++++++++++++++
>  5 files changed, 55 insertions(+)
>  create mode 100644 MdeModulePkg/Include/Guid/MigratedFvInfo.h

Comment fixes only (relative to v5); my A-b stands.

Laszlo