Re: [edk2-devel] [PATCH v2 0/9] Migrate Pointer from flash to permanent memory (CVE-2019-11098)

Hi, I'm adding Michael Kubacki's new email address to the "To:" list, as Michael has authored a significant portion of this code, plus he seems to have contributed a large part of the design, in . Also CC'ing Ard. Comments below. On 07/02/20

Re: [edk2-devel] [PATCH v2 0/9] Migrate Pointer from flash to permanent memory (CVE-2019-11098)

> Zhang, Qi1 > Subject: [edk2-devel] [PATCH v2 0/9] Migrate Pointer from flash to > permanent memory (CVE-2019-11098) > > The TOCTOU vulnerability allow that the physical present person to replace > the code with the normal BootGuard check and PCR0 value. > The issue occur whe

[edk2-devel] [PATCH v2 0/9] Migrate Pointer from flash to permanent memory (CVE-2019-11098)

The TOCTOU vulnerability allow that the physical present person to replace the code with the normal BootGuard check and PCR0 value. The issue occur when BootGuard measure IBB and access flash code after NEM disable. the reason why we access the flash code is that we have some pointer to flash. To