From c248d6a409455cafd49598a86853b9416b57605c Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 12 Mar 2026 14:31:42 +0100 Subject: [PATCH 1/2] pcrlock: don't accept PCRs > 23 from firmware event log Let's harden ourselves against shitty firmware which might report an invalid PCR. (This is not really a security issue, more a robustness issue, after all firmware generally comes with highest privileges and trust, even though it might just be shit) Fixes an issue found with Claude code review --- src/pcrlock/pcrlock.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/pcrlock/pcrlock.c b/src/pcrlock/pcrlock.c index acf68d698b..2d3c086261 100644 --- a/src/pcrlock/pcrlock.c +++ b/src/pcrlock/pcrlock.c @@ -949,6 +949,11 @@ static int event_log_load_firmware(EventLog *el) { continue; } + if (event->pcrIndex >= TPM2_PCRS_MAX) { + log_debug("Skipping event on PCR %" PRIu32 " (out of range).", event->pcrIndex); + continue; + } + r = event_log_add_record(el, &record); if (r < 0) return log_error_errno(r, "Failed to add record to event log: %m"); From bb19b6104978b5ede792fa3f0cfc74272f20bf9c Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 12 Mar 2026 14:41:43 +0100 Subject: [PATCH 2/2] measure: figure success of measurement correctly Found by Claude Code Review. --- src/boot/measure.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/boot/measure.c b/src/boot/measure.c index 22129cb87d..3c51998d1b 100644 --- a/src/boot/measure.c +++ b/src/boot/measure.c @@ -309,7 +309,7 @@ EFI_STATUS tpm_log_tagged_event( } err = tpm2_measure_to_pcr_and_tagged_event_log(tpm2, pcrindex, buffer, buffer_size, event_id, description); - if (!err) + if (err != EFI_SUCCESS) return err; *ret_measured = true;