Prepare 5.5.1

docs/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 Starting with release 5.4, The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## 5.5.1 - 2024-04-26
+### Security
+- Fixed CVE-2024-29038
+- Fixed CVE-2024-29039
+
 ## 5.5 - 2022-02-13
 
 ### Added

tools/misc/tpm2_checkquote.c

@@ -54,6 +54,37 @@ static tpm2_verifysig_ctx ctx = {
         .pcr_hash = TPM2B_TYPE_INIT(TPM2B_DIGEST, buffer),
 };
 
+static bool compare_pcr_selection(TPML_PCR_SELECTION *attest_sel, TPML_PCR_SELECTION *pcr_sel) {
+    if (attest_sel->count != pcr_sel->count) {
+        LOG_ERR("Selection sizes do not match.");
+        return false;
+    }
+    for (uint32_t i = 0; i < attest_sel->count; i++) {
+        for (uint32_t j = 0; j < pcr_sel->count; j++) {
+            if (attest_sel->pcrSelections[i].hash ==
+                pcr_sel->pcrSelections[j].hash) {
+                if (attest_sel->pcrSelections[i].sizeofSelect !=
+                        pcr_sel->pcrSelections[j].sizeofSelect) {
+                    LOG_ERR("Bitmask size does not match");
+                    return false;
+                }
+                if (memcmp(&attest_sel->pcrSelections[i].pcrSelect[0],
+                           &pcr_sel->pcrSelections[j].pcrSelect[0],
+                           attest_sel->pcrSelections[i].sizeofSelect) != 0) {
+                    LOG_ERR("Selection bitmasks do not match");
+                    return false;
+                }
+                break;
+            }
+            if (j == pcr_sel->count - 1) {
+                LOG_ERR("Hash selections to not match.");
+                return false;
+            }
+        }
+    }
+    return true;
+}
+
 static bool verify(void) {
 
     bool result = false;
@@ -128,6 +159,13 @@ static bool verify(void) {
         goto err;
     }
 
+    // check magic
+    if (ctx.attest.magic != TPM2_GENERATED_VALUE) {
+        LOG_ERR("Bad magic, got: 0x%x, expected: 0x%x",
+                ctx.attest.magic, TPM2_GENERATED_VALUE);
+        return false;
+    }
+
     // Also ensure digest from quote matches PCR digest
     if (ctx.flags.pcr) {
         if (!tpm2_util_verify_digests(&ctx.attest.attested.quote.pcrDigest,
@@ -387,7 +425,7 @@ static tool_rc init(void) {
     }
 
     TPM2B_ATTEST *msg = NULL;
-    TPML_PCR_SELECTION pcr_select;
+    TPML_PCR_SELECTION pcr_select = { 0 };
     tpm2_pcrs *pcrs;
     tpm2_pcrs temp_pcrs = {};
     tool_rc return_value = tool_rc_general_error;
@@ -550,6 +588,14 @@ static tool_rc init(void) {
         goto err;
     }
 
+    if (ctx.flags.pcr) {
+        if (!compare_pcr_selection(&ctx.attest.attested.quote.pcrSelect,
+                                   &pcr_select)) {
+            LOG_ERR("PCR selection does not match PCR slection from attest!");
+            goto err;
+        }
+    }
+
     // Figure out the digest for this message
     res = tpm2_openssl_hash_compute_data(ctx.halg, msg->attestationData,
             msg->size, &ctx.msg_hash);