tpm2-sessions: Fix out of range indexing in name_size

Browse source

commit 6e9722e9a7 upstream.

'name_size' does not have any range checks, and it just directly indexes
with TPM_ALG_ID, which could lead into memory corruption at worst.

Address the issue by only processing known values and returning -EINVAL for
unrecognized values.

Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so
that errors are detected before causing any spurious TPM traffic.

End also the authorization session on failure in both of the functions, as
the session state would be then by definition corrupted.

Cc: stable@vger.kernel.org # v6.10+
Fixes: 1085b8276b ("tpm: Add the rest of the session HMAC API")
Reviewed-by: Jonathan McDowell <noodles@meta.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Jarkko Sakkinen 2025-11-30 21:07:12 +02:00 • committed by Greg Kroah-Hartman

parent 42440155fe

commit 47e676ce4d

4 changed files with 126 additions and 53 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

23

drivers/char/tpm/tpm2-cmd.c

View file

114

drivers/char/tpm/tpm2-sessions.c

View file

13

include/linux/tpm.h

View file

29

security/keys/trusted-keys/trusted_tpm2.c

View file