Does Heads Issue #2256 Affect Qubes Certified Hardware?

[kzlz]

Does the TPM GPIO reset vulnerability described in Heads Issue #2256 also affect Qubes OS certified hardware.

Should affected hardware still be considered secure for TPM-based security features?

here is the vulnerability

ALL dTPM BASED PLATFORMS SHOULD BE CONSIDERED VULNERABLE FOR NOW

[FranklyFlawless]

It does for at least one Qubes-certified model, the NovaCustom NV41 series:

@Insurgo

This vulnerability is HW design flaw CONFIRMED on Intel with dTPM being electrically muxed through shared GPIO with what Intel named “Primary to Sideband Bridge” (P2SB) on Skylake+

---

Proven vulnerable (no false negative)

• nv4x_adl
• x280

NovaCustom V540TU currently has limited testing:

V540TU (v54x_mtl_igpu) results (uncertain)

The rest are not Qubes-certified models (Lenovo ThinkPad X280 and T480).

[Tonux]

The concern is that the testing utility was giving false negatives and that any Intel Skylake+ platforms are vulnerable due to Intel’s incorrect implementation and physical wiring of the TPM (when the TPM is reset, the whole CPU should reset, resetting the machine, it does not).

More info: TPM GPIO FAIL and supply chain issues, lack of CVE and accountability by IBV->ODM->OEM · Issue #7 · binarly-io/SupplyChainAttacks · GitHub

So, if correct, (almost?) all Qubes Certified boards using an discrete TPM and Intel CPU are vulnerable.