fix(tpm-qvl): expose only the attested event log in VerifiedReport - #1338
Merged
Merged
Conversation
kvinwang
force-pushed
the
fix/gcp-image-identity-attested-pcr2
branch
from
September 23, 2026 07:24
0920a90 to
2b51ad5
Compare
kvinwang
changed the title
The TPM event log carries no signature; an entry is attested only when
tpm-qvl replays it against a quoted PCR value, and only the PCRs in the
signed selection are replayed. The GCP image check nevertheless read the UKI
Authenticode digest from the raw `TpmQuote::event_log`, so for a quote over
e.g. {0, 14} its PCR-2 entries were never checked and could carry any digest.
`VerifiedReport` now carries `event_log`: the entries of the quoted PCRs,
all of which were replayed. The verifier reads the GCP image identity from
there instead of from the raw quote, like the Nitro arms already read from
the verified report.
Rejecting logs with entries for unquoted PCRs is not an option: GCP CVMs
ship the whole firmware log (PCRs 0-11) while quoting only {0, 2, 14}.
kvinwang
force-pushed
the
fix/gcp-image-identity-attested-pcr2
branch
from
September 23, 2026 07:34
2b51ad5 to
9b83478
Compare
kvinwang
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The TPM event log carries no signature; an entry is attested only when tpm-qvl replays it against a quoted PCR value, and only the PCRs in the signed selection are replayed. The GCP image check nevertheless read the UKI Authenticode digest from the raw
TpmQuote::event_log, so for a quote over e.g.{0, 14}its PCR-2 entries were never checked and could carry any digest.tpm_qvl::verify::VerifiedReportnow carriesevent_log: only the entries of quoted PCRs, all of which were replayed. The verifier reads the GCP image identity from there instead of from the raw quote, like the Nitro arms already read fromattestation.report.Rejecting logs with entries for unquoted PCRs is not an option: real GCP CVMs ship the whole firmware log (PCRs 0-11) while quoting only
{0, 2, 14}.Impact: not exploitable end-to-end today, because
decode_mr_gcp_tpm_from_v1independently requires PCR 2.POST /verifyand the KMS boot-auth path fail there first, so no key is released.--verify-certdoes reach the bypassed check, but the failed app-info decode makes it reportis_valid: falseand omitos_image_hash_verified.Split out of #1238.