This is in regards to this vulnerability and the state of current fix
for it. The vuln was reported by James Blake and this is the current fix
for it as far as I can tell:
http://hg.code.sf.net/p/tboot/code/code?cmd=changeset;node=0efdaf7c5348
In a posted message, it was pointed out that this fix is insufficient
and we believe that to be true too:
http://sourceforge.net/p/tboot/mailman/message/32760688/
It is not clear to me why the first item on the command line has to be
skipped when it happens to be the image file name. The command line is
what the boot-loader passed whether it includes a file name up front or
not. It seems a much simpler and cleaner approach would be like the one
from James Blake that I attached.
Thanks
--
Ross Philipson
tboot: measure all command line arguments (CVE-2014-5118)
JP Blake's patch to address CVE-2014-5118.
Upstream-status: This patch was submitted upstream, but tboot took a different
approach to fixing it. However, their fix is currently incomplete:
http://sourceforge.net/p/tboot/mailman/message/32760688/
Reported-by: James Blake <bla...@ainfosec.com>
Signed-off-by: James Blake <bla...@ainfosec.com>
Signed-off-by: Chris Patterson <patters...@ainfosec.com>
diff -rupN tboot-1.7.0/tboot/common/policy.c tboot-1.7.0-patched/tboot/common/policy.c
--- tboot-1.7.0/tboot/common/policy.c 2012-01-15 10:21:20.000000000 -0500
+++ tboot-1.7.0-patched/tboot/common/policy.c 2014-11-07 12:11:02.966141513 -0500
@@ -383,8 +383,6 @@ static bool hash_module(tb_hash_t *hash,
/* hash command line */
if ( cmdline == NULL )
cmdline = "";
- else
- cmdline = skip_filename(cmdline);
if ( !hash_buffer((const unsigned char *)cmdline, strlen(cmdline), hash,
hash_alg) )
return false;
------------------------------------------------------------------------------
_______________________________________________
tboot-devel mailing list
tboot-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tboot-devel
