summaryrefslogtreecommitdiffstats
path: root/MdeModulePkg
diff options
context:
space:
mode:
authorAbhi Singh <Abhi.Singh@arm.com>2023-04-12 15:26:55 -0500
committermergify[bot] <37929162+mergify[bot]@users.noreply.github.com>2023-07-10 12:24:59 +0000
commit63923a5642e86f386a5c719a90cfc6a929ea9cb0 (patch)
treec5feeba2da09529a950fa174e9b76271ac6202c3 /MdeModulePkg
parent96d691166f07b7ed422f9536832edadc0aea35c9 (diff)
downloadedk2-63923a5642e86f386a5c719a90cfc6a929ea9cb0.tar.gz
edk2-63923a5642e86f386a5c719a90cfc6a929ea9cb0.tar.bz2
edk2-63923a5642e86f386a5c719a90cfc6a929ea9cb0.zip
MdeModulePkg/Variable: TcgMorLockSmm Key Mismatch changes lock state
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4410 Inside TcgMorLockSmm.c, the SetVariableCheckHandlerMorLock() function contains a scenario to prevent a possible dictionary attack on the MorLock Key in accordance with the TCG Platform Reset Mitigation Spec v1.10. The mechanism to prevent this attack must also change the MorLock Variable Value to 0x01 to indicate Locked Without Key. ASSERT_EFI_ERROR is added for error visibility since SetMorLockVariable returns a status code Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Signed-off-by: Abhi Singh <Abhi.Singh@arm.com> Acked-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
Diffstat (limited to 'MdeModulePkg')
-rw-r--r--MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
index da1105ff07..28e8cc55d9 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
@@ -312,6 +312,11 @@ SetVariableCheckHandlerMorLock (
mMorLockState = MorLockStateLocked;
mMorLockKeyEmpty = TRUE;
ZeroMem (mMorLockKey, sizeof (mMorLockKey));
+ //
+ // Update value to reflect locked without key
+ //
+ Status = SetMorLockVariable (MOR_LOCK_DATA_LOCKED_WITHOUT_KEY);
+ ASSERT_EFI_ERROR (Status);
return EFI_ACCESS_DENIED;
}
}