[PATCH v2] KEYS: trusted: Reject short TPM2 public areas

[sashiko-bot at kernel.org]

> tpm2_load_cmd() reads TPMA_OBJECT with get_unaligned_be32(pub + 4), but
> does not require public_len to cover that field.
> 
> A TPM 2.0 ASN.1 key blob with public_len zero makes the read begin at the
> end of the B + 4-byte decoded allocation, causing a four-byte heap
> out-of-bounds read before the TPM command is transmitted. This is reachable
> from an unprivileged add_key() call when TPM trusted keys and a TPM2 device
> are available.
> 
> This affects v5.13-rc1 and later kernels built with CONFIG_TRUSTED_KEYS=y
> and CONFIG_TRUSTED_KEYS_TPM=y when a TPM2 device is present. A KASAN run
> as UID 1000 with no effective capabilities reported:
> 
> BUG: KASAN: slab-out-of-bounds in tpm2_unseal_trusted
> Read of size 4 at addr ffff888106273b48 by task exploit/160
> [ ... ]
> end-to-end QEMU and swtpm reproducer.
> 
> Fixes: e5fb5d2c5a03 ("security: keys: trusted: Make sealed key properly interoperable")
> Cc: stable at vger.kernel.org
> Signed-off-by: Daehyeon Ko <4ncienth at gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020161954.3956212-1-4ncienth@gmail.com?part=1