[PATCH] KEYS: trusted: Reject short TPM2 public areas

[sashiko-bot at kernel.org]

> tpm2_load_cmd() reads TPMA_OBJECT with get_unaligned_be32(pub + 4), but
> does not require public_len to cover that field.
> 
> A new-format blob with public_len zero makes the read begin at the end of
> the B + 4-byte decoded allocation, causing a four-byte heap out-of-bounds
> read before the TPM command is transmitted. This is reachable from an
> unprivileged add_key() call when TPM trusted keys and a TPM2 device are
> available.
> 
> This affects v5.13-rc1 and later kernels built with CONFIG_TRUSTED_KEYS=y
> and CONFIG_TRUSTED_KEYS_TPM=y when a TPM2 device is present. A KASAN run
> as UID 1000 with no effective capabilities reported:
> 
> BUG: KASAN: slab-out-of-bounds in tpm2_unseal_trusted
> Read of size 4 at addr ffff888106273b48 by task exploit/160
> [ ... ]
> 
> Fixes: e5fb5d2c5a03 ("security: keys: trusted: Make sealed key properly interoperable")
> Cc: stable at vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Daehyeon Ko <4ncienth at gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925095308.3248297-1-4ncienth@gmail.com?part=1