*** This bug is a security vulnerability *** You have been subscribed to a public security bug by Seth Arnold (seth-arnold):
My Gigabyte UEFI BIOS has an option to select which TPM chip to use. By default it uses AMD fTPM. After manually enabling Pluton fTPM via Gigabyte UEFI, TPM PCR0 reconstruction status changed to Invalid. Ubuntu Version: 23.10 Kernel: Xanmod 6.6.8, Generic 6.5.0-14 Version: org.freedesktop.fwupd 1.9.5 Log ``` Host Security ID: HSI:1 (v1.9.5) HSI-1 ✔ Fused platform: Locked ✔ Supported CPU: Valid ✔ TPM empty PCRs: Valid ✔ TPM v2.0: Found ✔ UEFI bootservice variables: Locked ✔ UEFI platform key: Valid ✔ UEFI secure boot: Enabled HSI-2 ✔ IOMMU: Enabled ✔ Platform debugging: Locked ✔ SPI write protection: Enabled ✘ TPM PCR0 reconstruction: Invalid HSI-3 ✔ Pre-boot DMA protection: Enabled ✘ SPI replay protection: Not supported ✘ Suspend-to-idle: Disabled ✘ Suspend-to-ram: Enabled HSI-4 ✘ Encrypted RAM: Not supported ✘ Processor rollback protection: Disabled Runtime Suffix -! ✔ Linux kernel: Untainted ✔ Linux kernel lockdown: Enabled ✔ Linux swap: Encrypted ✔ fwupd plugins: Untainted The TPM PCR0 differs from reconstruction. » https://fwupd.github.io/hsi.html#pcr0-tpm-event-log-reconstruction Host Security Events 2023-12-25 18:39:14: ✘ TPM PCR0 reconstruction changed: Valid → Invalid ``` ** Affects: fwupd (Ubuntu) Importance: Undecided Status: New ** Tags: pluton -- TPM PCR0 recontruction fails on Pluton fTPM https://bugs.launchpad.net/bugs/2047374 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to the bug report. -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
