linux-kernel - [PATCH 43/91] TPM: Call tpm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20120205220951.290345345@pcw.home.local>
Date:	Sun, 05 Feb 2012 23:10:32 +0100
From:	Willy Tarreau <w@....eu>
To:	linux-kernel@...r.kernel.org, stable@...r.kernel.org
Cc:	Rajiv Andrade <srajiv@...ux.vnet.ibm.com>,
	James Morris <jmorris@...ei.org>,
	Greg KH <gregkh@...uxfoundation.org>
Subject: [PATCH 43/91] TPM: Call tpm_transmit with correct size

2.6.27-longterm review patch.  If anyone has any objections, please let us know.

------------------

commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 upstream.

This patch changes the call of tpm_transmit by supplying the size of the
userspace buffer instead of TPM_BUFSIZE.

This got assigned CVE-2011-1161.

[The first hunk didn't make sense given one could expect
 way less data than TPM_BUFSIZE, so added tpm_transmit boundary
 check over bufsiz instead
 The last parameter of tpm_transmit() reflects the amount
 of data expected from the device, and not the buffer size
 being supplied to it. It isn't ideal to parse it directly,
 so we just set it to the maximum the input buffer can handle
 and let the userspace API to do such job.]

Signed-off-by: Rajiv Andrade <srajiv@...ux.vnet.ibm.com>
Signed-off-by: James Morris <jmorris@...ei.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
---
 drivers/char/tpm/tpm.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

Index: longterm-2.6.27/drivers/char/tpm/tpm.c
===================================================================
--- longterm-2.6.27.orig/drivers/char/tpm/tpm.c	2012-02-05 22:34:33.730914904 +0100
+++ longterm-2.6.27/drivers/char/tpm/tpm.c	2012-02-05 22:34:40.951915689 +0100
@@ -375,6 +375,9 @@
 	u32 count, ordinal;
 	unsigned long stop;

+	if (bufsiz > TPM_BUFSIZE)
+		bufsiz = TPM_BUFSIZE;
+
 	count = be32_to_cpu(*((__be32 *) (buf + 2)));
 	ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
 	if (count == 0)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/