linux-kernel - Re: [PATCH] TPM: get_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.00.0905140824420.26222@tundra.namei.org>
Date:	Thu, 14 May 2009 08:24:52 +1000 (EST)
From:	James Morris <jmorris@...ei.org>
To:	Eric Paris <eparis@...hat.com>
cc:	debora@...ux.vnet.ibm.com, srajiv@...ux.vnet.ibm.com,
	m.selhorst@...rix.com, tpmdd-devel@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] TPM: get_event_name stack corruption

On Wed, 13 May 2009, Eric Paris wrote:

> get_event_name uses sprintf to fill a buffer declared on the stack.  It fills
> the buffer 2 bytes at a time.  What the code doesn't take into account is that
> sprintf(buf, "%02x", data) actually writes 3 bytes.  2 bytes for the data and
> then it nul terminates the string.  Since we declare buf to be 40 characters
> long and then we write 40 bytes of data into buf sprintf is going to write 41
> characters.  The fix is to leave room in buf for the nul terminator.
> 
> Signed-off-by: Eric Paris <eparis@...hat.com>

Applied to 
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

> ---
> 
>  drivers/char/tpm/tpm_bios.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
> index ed306eb..0c2f55a 100644
> --- a/drivers/char/tpm/tpm_bios.c
> +++ b/drivers/char/tpm/tpm_bios.c
> @@ -212,7 +212,8 @@ static int get_event_name(char *dest, struct tcpa_event *event,
>  			unsigned char * event_entry)
>  {
>  	const char *name = "";
> -	char data[40] = "";
> +	/* 41 so there is room for 40 data and 1 nul */
> +	char data[41] = "";
>  	int i, n_len = 0, d_len = 0;
>  	struct tcpa_pc_event *pc_event;
>  
> 

-- 
James Morris
<jmorris@...ei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/