[PATCH v3] tpm-dev-common: Reject too short writes

Path	csiph.com!news.redatomik.org!aioe.org!bofh.it!news.nic.it!robomod
From	Alexander Steffen <Alexander.Steffen@infineon.com>
Newsgroups	linux.kernel
Subject	[PATCH v3] tpm-dev-common: Reject too short writes
Date	Fri, 08 Sep 2017 17:30:02 +0200
Message-ID	<untoe-qu-5@gated-at.bofh.it> (permalink)
Dkim-Signature	v=1; a=rsa-sha256; c=simple/simple; d=infineon.com; i=@infineon.com; q=dns/txt; s=IFXMAIL; t=1504884158; x=1536420158; h=from:to:cc:subject:date:message-id:mime-version; bh=AifLPsXKz45hDM5ojmdtLflzsPMxjMeReZpwJ7ZIiFs=; b=CUgSxVi0C9/T5pzYj9kk21BrC1uQTXMGHl1jm39WHOPwjT7MDU4uL943 rXdC57xjWjlj+3byBvpRNJQhum4ft7q5VZqv+9M2bWtzyNyTs8rmDZm4y g28DGi8zjmC9BvkEpoPZvDKS2JDBKB4dy1Bf8PR1A7o7qt7RDGV4ZFS37 k=;
X-Sbrs	None
X-Mailer	git-send-email 2.11.1.windows.1
MIME-Version	1.0
Content-Type	text/plain
X-Originating-IP	[172.29.170.94]
X-Clientproxiedby	MUCSE601.infineon.com (172.23.7.102) To MUCSE603.infineon.com (172.23.7.104)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	42
Organization	linux.* mail to news gateway
X-Original-Cc	<linux-kernel@vger.kernel.org>, <linux-security-module@vger.kernel.org>, Alexander Steffen <Alexander.Steffen@infineon.com>, <stable@vger.kernel.org>
X-Original-Date	Fri, 8 Sep 2017 17:21:32 +0200
X-Original-Message-ID	<20170908152132.8728-1-Alexander.Steffen@infineon.com>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1729022

Show key headers only | View raw

tpm_transmit() does not offer an explicit interface to indicate the number
of valid bytes in the communication buffer. Instead, it relies on the
commandSize field in the TPM header that is encoded within the buffer.
Therefore, ensure that a) enough data has been written to the buffer, so
that the commandSize field is present and b) the commandSize field does not
announce more data than has been written to the buffer.

This should have been fixed with CVE-2011-1161 long ago, but apparently
a correct version of that patch never made it into the kernel.

Cc: stable@vger.kernel.org
Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com>
---
v2:
- Moved all changes to tpm_common_write in a single patch.
v3:
- Access data copied from user space (priv->data_buffer) instead of user
  space data directly (buf).
- Changed return code to EINVAL.

 drivers/char/tpm/tpm-dev-common.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index 610638a..461bf0b 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -110,6 +110,12 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
 		return -EFAULT;
 	}
 
+	if (in_size < 6 ||
+	    in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) {
+		mutex_unlock(&priv->buffer_mutex);
+		return -EINVAL;
+	}
+
 	/* atomic tpm command send and result receive. We only hold the ops
 	 * lock during this period so that the tpm can be unregistered even if
 	 * the char dev is held open.
-- 
2.7.4

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH v3] tpm-dev-common: Reject too short writes Alexander Steffen <Alexander.Steffen@infineon.com> - 2017-09-08 17:30 +0200
  Re: [PATCH v3] tpm-dev-common: Reject too short writes Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-09-08 23:40 +0200
    Re: [PATCH v3] tpm-dev-common: Reject too short writes Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2017-09-09 15:00 +0200

csiph-web