Re: [PATCH 2/2] tpm: sessions: bound the parameter decryption by the response size

[Jarkko Sakkinen]

On Fri, Nov 06, 2026 at 09:49:36AM +0800, Guo Zihao wrote:
> tpm_buf_check_hmac_response() decrypts the parameter area of a
> response for sessions with TPM2_SA_ENCRYPT set:
> 
> 	len = tpm_buf_read_u16(buf, &offset_p);
> 	aes_prepareenckey(&auth->aes_key, auth->scratch, AES_KEY_BYTES);
> 	aescfb_decrypt(&auth->aes_key, &buf->data[offset_p],
> 		       &buf->data[offset_p], len,
> 		       auth->scratch + AES_KEY_BYTES);
> 
> The length is read from the response itself and never checked
> against the buffer: every other size taken from a session response
> is compared to tpm_buf_length(), but not this one. A TPM that
> reports an oversized parameter area makes aescfb_decrypt() walk
> past the end of the buffer, and since the decryption is done in
> place, this both reads and writes whatever follows the received
> data.
> 
> Check that the encrypted parameters fit in the response before
> decrypting them.
> 
> Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>

Ditto.

Br, Jarkko