From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id 4F2A0D8106C for ; Wed, 8 May 2024 07:35:45 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=ccL+F1kXwZMYpKAc+abKUZI33IAwx14VuBtFsvD/XMQ=; c=relaxed/simple; d=groups.io; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Transfer-Encoding; s=20240206; t=1715153743; v=1; b=nbWP1TsOdQ8nX00cr2Ru03VCrykw//seZ8LDtJg8dtm5Abt65mXlmomTbiP80tY7tFqKX8AK Cg7TftO+nwP8qJdl2fpDSV8yYGh+cB22kPsqZMuiTYlK/pw7IMNHILMiDRl/6aeRCvVJ5DTbCBs HwU+hIJvXCDYUvuzd3InLPL3nGS48oLA7Uc85xkSfgs3VOdGKc8nWV1zAv+chepCWRsrR9lh3SY n1hmJRBBJ0wyqPxay/5I937iO/fRCmdZnBKYQFMG2GcUJe2bi0L9Y/tMCB0tz7hLVNKDoccrbRb nMG7j9jVS5Kdh07OndBGb5Ww/0FFMYeg/HYQc201lhPvw== X-Received: by 127.0.0.2 with SMTP id ITZfYY7687511xj9mV4VFKhY; Wed, 08 May 2024 00:35:43 -0700 X-Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by mx.groups.io with SMTP id smtpd.web10.1502.1715027285946367810 for ; Mon, 06 May 2024 13:28:06 -0700 X-Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 446JuM5P019523; Mon, 6 May 2024 20:28:03 GMT X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3xy55n05vh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 May 2024 20:28:03 +0000 X-Received: from m0353725.ppops.net (m0353725.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 446KS2nW009259; Mon, 6 May 2024 20:28:02 GMT X-Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3xy55n05vf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 May 2024 20:28:02 +0000 X-Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 446HkZPY005882; Mon, 6 May 2024 20:28:02 GMT X-Received: from smtprelay05.dal12v.mail.ibm.com ([172.16.1.7]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 3xx5yh0pw0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 06 May 2024 20:28:02 +0000 X-Received: from smtpav01.wdc07v.mail.ibm.com (smtpav01.wdc07v.mail.ibm.com [10.39.53.228]) by smtprelay05.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 446KRwPt17171000 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 6 May 2024 20:28:01 GMT X-Received: from smtpav01.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8D02A5805B; Mon, 6 May 2024 20:27:58 +0000 (GMT) X-Received: from smtpav01.wdc07v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E30E158066; Mon, 6 May 2024 20:27:57 +0000 (GMT) X-Received: from amdrome3.watson.ibm.com (unknown [9.2.130.16]) by smtpav01.wdc07v.mail.ibm.com (Postfix) with ESMTP; Mon, 6 May 2024 20:27:57 +0000 (GMT) From: Tobin Feldman-Fitzthum To: devel@edk2.groups.io Cc: dov.murik@gmail.com, james.bottomley@hansenpartnership.com, thomas.lendacky@amd.com, tobin@ibm.com, Tobin Feldman-Fitzthum Subject: [edk2-devel] [PATCH 2/2] AmdSev: Halt on failed blob allocation Date: Mon, 6 May 2024 20:27:36 +0000 Message-Id: <267051ecc086a193b9f22377d0159022d49c0100.1715024059.git.tobin@linux.ibm.com> In-Reply-To: References: MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: 4naClg9CqDcIpBWXJtgfHD8ir3A1QgPG X-Proofpoint-GUID: hyDUKpxUOEwHAWc7PnsD-b3Fij_xBead Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Wed, 08 May 2024 00:35:40 -0700 Resent-From: tobin@linux.ibm.com Reply-To: devel@edk2.groups.io,tobin@linux.ibm.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: kT319hr8pOoQ2nUWfTqxPlfGx7686176AA= Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=nbWP1TsO; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=ibm.com (policy=none) A malicious host may be able to undermine the fw_cfg interface such that loading a blob fails. In this case rather than continuing to the next boot option, the blob verifier should halt. For non-confidential guests, the error should be non-fatal. Signed-off-by: Tobin Feldman-Fitzthum --- .../BlobVerifierSevHashes.c | 17 ++++++++++++++++- OvmfPkg/Include/Library/BlobVerifierLib.h | 14 ++++++++++---- .../BlobVerifierLibNull/BlobVerifierNull.c | 13 ++++++++----- .../QemuKernelLoaderFsDxe.c | 9 ++++----- 4 files changed, 38 insertions(+), 15 deletions(-) diff --git a/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.= c b/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c index ee8bca509a..c550518d73 100644 --- a/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c +++ b/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c @@ -83,6 +83,7 @@ FindBlobEntryGuid ( @param[in] BlobName The name of the blob=0D @param[in] Buf The data of the blob=0D @param[in] BufSize The size of the blob in bytes=0D + @param[in] FetchStatus The status of the previous blob fetch=0D =0D @retval EFI_SUCCESS The blob was verified successfully or was = not=0D found in the hash table.=0D @@ -94,13 +95,27 @@ EFIAPI VerifyBlob (=0D IN CONST CHAR16 *BlobName,=0D IN CONST VOID *Buf,=0D - IN UINT32 BufSize=0D + IN UINT32 BufSize,=0D + IN EFI_STATUS FetchStatus=0D )=0D {=0D CONST GUID *Guid;=0D INT32 Remaining;=0D HASH_TABLE *Entry;=0D =0D + // Enter a dead loop if the fetching of this blob=0D + // failed. This prevents a malicious host from=0D + // circumventing the following checks.=0D + if (EFI_ERROR (FetchStatus)) {=0D + DEBUG ((=0D + DEBUG_ERROR,=0D + "%a: Fetching blob failed.\n",=0D + __func__=0D + ));=0D +=0D + CpuDeadLoop ();=0D + }=0D +=0D if ((mHashesTable =3D=3D NULL) || (mHashesTableSize =3D=3D 0)) {=0D DEBUG ((=0D DEBUG_WARN,=0D diff --git a/OvmfPkg/Include/Library/BlobVerifierLib.h b/OvmfPkg/Include/Li= brary/BlobVerifierLib.h index 7e1af27574..efe26734b1 100644 --- a/OvmfPkg/Include/Library/BlobVerifierLib.h +++ b/OvmfPkg/Include/Library/BlobVerifierLib.h @@ -19,20 +19,26 @@ /**=0D Verify blob from an external source.=0D =0D + If a non-secure configuration is detected this function will enter a=0D + dead loop to prevent a boot.=0D +=0D @param[in] BlobName The name of the blob=0D @param[in] Buf The data of the blob=0D @param[in] BufSize The size of the blob in bytes=0D + @param[in] FetchStatus The status of fetching this blob=0D =0D - @retval EFI_SUCCESS The blob was verified successfully.=0D - @retval EFI_ACCESS_DENIED The blob could not be verified, and theref= ore=0D - should be considered non-secure.=0D + @retval EFI_SUCCESS The blob was verified successfully or was = not=0D + found in the hash table.=0D + @retval EFI_ACCESS_DENIED Kernel hashes not supported but the boot c= an=0D + continue safely.=0D **/=0D EFI_STATUS=0D EFIAPI=0D VerifyBlob (=0D IN CONST CHAR16 *BlobName,=0D IN CONST VOID *Buf,=0D - IN UINT32 BufSize=0D + IN UINT32 BufSize,=0D + IN EFI_STATUS FetchStatus=0D );=0D =0D #endif=0D diff --git a/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c b/OvmfP= kg/Library/BlobVerifierLibNull/BlobVerifierNull.c index e817c3cc95..db5320571c 100644 --- a/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c +++ b/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c @@ -16,18 +16,21 @@ @param[in] BlobName The name of the blob=0D @param[in] Buf The data of the blob=0D @param[in] BufSize The size of the blob in bytes=0D + @param[in] FetchStatus The status of the fetch of this blob=0D =0D - @retval EFI_SUCCESS The blob was verified successfully.=0D - @retval EFI_ACCESS_DENIED The blob could not be verified, and theref= ore=0D - should be considered non-secure.=0D + @retval EFI_SUCCESS The blob was verified successfully or was = not=0D + found in the hash table.=0D + @retval EFI_ACCESS_DENIED Kernel hashes not supported but the boot c= an=0D + continue safely.=0D **/=0D EFI_STATUS=0D EFIAPI=0D VerifyBlob (=0D IN CONST CHAR16 *BlobName,=0D IN CONST VOID *Buf,=0D - IN UINT32 BufSize=0D + IN UINT32 BufSize,=0D + IN EFI_STATUS FetchStatus=0D )=0D {=0D - return EFI_SUCCESS;=0D + return FetchStatus;=0D }=0D diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPk= g/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c index 3c12085f6c..cf58c97cd2 100644 --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c @@ -1042,6 +1042,7 @@ QemuKernelLoaderFsDxeEntrypoint ( KERNEL_BLOB *CurrentBlob;=0D KERNEL_BLOB *KernelBlob;=0D EFI_STATUS Status;=0D + EFI_STATUS FetchStatus;=0D EFI_HANDLE FileSystemHandle;=0D EFI_HANDLE InitrdLoadFile2Handle;=0D =0D @@ -1060,15 +1061,13 @@ QemuKernelLoaderFsDxeEntrypoint ( //=0D for (BlobType =3D 0; BlobType < KernelBlobTypeMax; ++BlobType) {=0D CurrentBlob =3D &mKernelBlob[BlobType];=0D - Status =3D FetchBlob (CurrentBlob);=0D - if (EFI_ERROR (Status)) {=0D - goto FreeBlobs;=0D - }=0D + FetchStatus =3D FetchBlob (CurrentBlob);=0D =0D Status =3D VerifyBlob (=0D CurrentBlob->Name,=0D CurrentBlob->Data,=0D - CurrentBlob->Size=0D + CurrentBlob->Size,=0D + FetchStatus=0D );=0D if (EFI_ERROR (Status)) {=0D goto FreeBlobs;=0D --=20 2.34.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#118663): https://edk2.groups.io/g/devel/message/118663 Mute This Topic: https://groups.io/mt/105977015/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-