lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 021/849] tpm: Check for integer overflow in tpm2_map_response_body()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    commit a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 upstream.

    The "4 * be32_to_cpu(data->count)" multiplication can potentially
    overflow which would lead to memory corruption. Add a check for that.

    Cc: stable@vger.kernel.org
    Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
    Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/char/tpm/tpm2-space.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/char/tpm/tpm2-space.c
    +++ b/drivers/char/tpm/tpm2-space.c
    @@ -455,6 +455,9 @@ static int tpm2_map_response_body(struct
    if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES)
    return 0;

    + if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4)
    + return -EFAULT;
    +
    if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count))
    return -EFAULT;


    \
     
     \ /
      Last update: 2021-11-15 22:22    [W:4.015 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site