EDK II GPT TPM PCR[5] Measurement Mismatch

CVE-2024-13745 is a flaw in EDK II’s GPT measurement and parsing logic that allows the GUID Partition Table layout or metadata actually used by firmware to differ from what is measured into TPM PCR[5]. According to the disclosure, affected versions include EDK II releases up to and including edk2-stable202411, and later versions may also be affected because no fix was known at disclosure time. The issue arises from inconsistencies between DxeTpm2MeasureBootLib, which measures GPT data for TPM event logging, and PartitionDxe, which parses, validates, and may recover GPT structures for actual use. DxeTpm2MeasureBootLib reads the GPT header from LBA 1, applies comparatively relaxed validation, does not validate CRC32 checksums, does not consult the backup GPT header, and omits unused GPT partition entries from the measured structure. PartitionDxe, by contrast, performs stricter validation, reads both primary and backup GPT headers, and includes recovery logic. The disclosure further describes error-handling flaws in PartitionRestoreGptTable() and PartitionValidGptTable() where failures can leave PrimaryHeader populated with untrusted invalid data while execution continues down a path treating both GPT tables as valid. An attacker can exploit these discrepancies by preserving the GPT data that DxeTpm2MeasureBootLib measures while causing PartitionDxe to recover or use a different GPT header and partition entry array, including via malformed backup GPT headers and attacker-controlled AlternateLBA values. The result is a data-only integrity failure in which PCR[5] and TPM event logs can indicate an expected GPT state while firmware and the operating system use attacker-influenced partition layout or metadata.