lkml.org 
[lkml]   [2018]   [Mar]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 07/65] tpm-dev-common: Reject too short writes
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alexander Steffen <Alexander.Steffen@infineon.com>

    commit ee70bc1e7b63ac8023c9ff9475d8741e397316e7 upstream.

    tpm_transmit() does not offer an explicit interface to indicate the number
    of valid bytes in the communication buffer. Instead, it relies on the
    commandSize field in the TPM header that is encoded within the buffer.
    Therefore, ensure that a) enough data has been written to the buffer, so
    that the commandSize field is present and b) the commandSize field does not
    announce more data than has been written to the buffer.

    This should have been fixed with CVE-2011-1161 long ago, but apparently
    a correct version of that patch never made it into the kernel.

    Cc: stable@vger.kernel.org
    Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com>
    Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/char/tpm/tpm-dev.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/drivers/char/tpm/tpm-dev.c
    +++ b/drivers/char/tpm/tpm-dev.c
    @@ -136,6 +136,12 @@ static ssize_t tpm_write(struct file *fi
    return -EFAULT;
    }

    + if (in_size < 6 ||
    + in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) {
    + mutex_unlock(&priv->buffer_mutex);
    + return -EINVAL;
    + }
    +
    /* atomic tpm command send and result receive. We only hold the ops
    * lock during this period so that the tpm can be unregistered even if
    * the char dev is held open.

    \
     
     \ /
      Last update: 2018-03-10 01:21    [W:5.087 / U:0.660 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site