diff options
| author | Daehyeon Ko <4ncienth@gmail.com> | 2026-09-25 18:53:08 +0900 |
|---|---|---|
| committer | Jarkko Sakkinen <jarkko@kernel.org> | 2026-09-29 22:15:03 +0300 |
| commit | 1c5264b465ad0d2706e03dd0ca648cdffd7ccf0a (patch) | |
| tree | a053dc61bc72210259617fbc6453585f6204ee42 /security/keys | |
| parent | 25d6a2c5965b7dd4f284365a1b7f525d839f86d3 (diff) | |
| download | linux-next-1c5264b465ad0d2706e03dd0ca648cdffd7ccf0a.tar.gz linux-next-1c5264b465ad0d2706e03dd0ca648cdffd7ccf0a.zip | |
KEYS: trusted: Reject short TPM2 public areas
tpm2_load_cmd() reads TPMA_OBJECT with get_unaligned_be32(pub + 4), but
does not require public_len to cover that field.
A new-format blob with public_len zero makes the read begin at the end of
the B + 4-byte decoded allocation, causing a four-byte heap out-of-bounds
read before the TPM command is transmitted. This is reachable from an
unprivileged add_key() call when TPM trusted keys and a TPM2 device are
available.
This affects v5.13-rc1 and later kernels built with CONFIG_TRUSTED_KEYS=y
and CONFIG_TRUSTED_KEYS_TPM=y when a TPM2 device is present. A KASAN run
as UID 1000 with no effective capabilities reported:
BUG: KASAN: slab-out-of-bounds in tpm2_unseal_trusted
Read of size 4 at addr ffff888106273b48 by task exploit/160
CPU: 1 UID: 1000 PID: 160 Comm: exploit
The buggy address belongs to the object at ffff888106273b40
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes to the right of
allocated 8-byte region [ffff888106273b40, ffff888106273b48)
TPMT_PUBLIC starts with the two-byte type, two-byte nameAlg and four-byte
objectAttributes fields. Require public_len to cover all eight bytes before
reading the attributes.
The exact input produced the KASAN read in 3/3 fresh boots. The fixed build
rejected it with -E2BIG and no KASAN report in 3/3 boots; valid new- and
old-format trusted-key loads continued to succeed.
Cc: stable@vger.kernel.org # v5.15+
Fixes: e5fb5d2c5a03 ("security: keys: trusted: Make sealed key properly interoperable")
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Link: https://lore.kernel.org/r/20260925095308.3248297-1-4ncienth@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Diffstat (limited to 'security/keys')
| -rw-r--r-- | security/keys/trusted-keys/trusted_tpm2.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index a9b8a31a637c..c176ceba7859 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -413,6 +413,8 @@ static int tpm2_load_cmd(struct tpm_chip *chip, public_len = get_unaligned_be16(blob + 2 + private_len); if (private_len + 2 + public_len + 2 > blob_len) return -E2BIG; + if (public_len < 8) + return -E2BIG; pub = blob + 2 + private_len + 2; /* key attributes are always at offset 4 */ |