High Confidence classification ignores measured-boot log overflow on EOSL OEM firmware
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- python
- Domain
- operating-systems, security
Research direction
Start by reviewing the linked inspiron-5559-tcg-log-overflow evidence and the classification behavior described in this issue; no repository file or test is identified. Done means either PCR7 bindability and log completeness affect EOSL firmware classification, or the affected platforms are explicitly documented as unsupported for full dbx deployment.
Written by the indexing model from the issue text.
Description
Device bucket a76a9c670a8c139d3d783551a435fd5c4948f898d8acc23f9a05a65c1db5021d stayed High Confidence after Windows successfully wrote the 2023 db certificates.
On Dell Inspiron 5559 BIOS 1.9.0 that write grew db from 3,143 to 7,636 bytes. Combined with a current dbx (~23 KB), the firmware TCG log exceeded a ~32 KiB buffer. Logging stopped; PCR extension continued. BitLocker then failed with FVE_E_NO_TPM_BIOS / Event 813 / Event 1796.
High Confidence here means “the variable write succeeded,” which is exactly what destroyed measured boot.
Evidence: https://github.com/Sizzlechest/inspiron-5559-tcg-log-overflow
Ask: treat PCR7 bindability / log completeness as a classification input for EOSL firmware, or document these platforms as not supported for full dbx deployment.
- Dominant language
- Python
- Stars
- 289
- Forks
- 89
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 7
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/secureboot_objects
-
state:needs-owner state:needs-triage type:bug urgency:high
Difficulty 4/5 3-5 days Newbie friendliness 55/100
microsoft/secureboot_objects#467 · 3 comments ·
-
state:needs-triage type:feature-request urgency:low
Difficulty 3/5 1-2 days Newbie friendliness 55/100
microsoft/secureboot_objects#466 ·
-
state:needs-triage type:feature-request urgency:low
Difficulty 4/5 3-5 days Newbie friendliness 48/100
microsoft/secureboot_objects#462 · 3 comments ·
-
state:needs-owner state:needs-triage type:bug urgency:low
Difficulty 3/5 1-2 days Newbie friendliness 68/100
microsoft/secureboot_objects#424 · 6 comments ·
-
state:needs-maintainer-feedback state:needs-owner state:needs-triage type:feature-request urgency:high
Difficulty 5/5 Over a week Newbie friendliness 20/100
microsoft/secureboot_objects#422 · 14 comments · 2 reactions ·
All issues in microsoft/secureboot_objects
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
learningequality/ricecooker#747 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
BSData/horus-heresy-3rd-edition#3171 ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
run-llama/llama_index#23199 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
KhronosGroup/glTF-Blender-IO#2769 ·