i.MX ProcessorsのトピックRe: HAB4

HAB4

vraevsky — Mon, 12 Feb 2024 17:00:37 GMT

Dear NXP Support,

We’d like to let you know about an issue we ran into while testing HAB4 with Mender on an imx8mp device.We were able to boot an unsigned kernel image on the signed/fused/closed u-boot 2022.04.

U-Boot boot cmd:

load mmc 2 ${loadaddr} EFI/BOOT/bootaa64.efi
load mmc 2 ${fdt_addr_r} device-tree-file.dtb
bootefi ${loadaddr} ${fdt_addr_r}

The bootloader hands over the control to the bootaa64.efi that loads and lets running an unsigned kernel Image.

Discovered: the u-boot does not issue the authenticate_image() function on bootefi.
I’d appreciate it if you could help in fixing that security issue.

Regards,
Valentin.

Re: HAB4

hector_delgado — Wed, 14 Feb 2024 18:34:05 GMT

Hi @vraevsky ,

I hope you're doing well!

I sent you an email regarding your case.

Thank you.

Best regards,
Hector.

Re: HAB4

vraevsky — Wed, 13 Mar 2024 09:24:18 GMT

Dear @hector_delgado ,

We have solved the issue this way:

https://github.com/compulab-yokneam/u-boot-compulab/commit/964c985b899f8c5707c95540baa9fa671f4597a0?diff=split&w=1

Regards,

Valentin.