Re: [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Jarkko Sakkinen]

On Sun, Aug 30, 2026 at 02:11:22PM +0530, sanket sharma wrote:
> Hi Jarkko,
> 
> Just checking in both patches (v3) have been sent as per the previous
> discussion: Message-ID: 20260826170700.616-1-sanketsharmacsec@xxxxxxxxx
> 
> Please let me know if anything else is needed from my side.
> 
> Also, regarding CVE assignment Greg pointed me to the kernel CVE doc, which
> mentions CVEs are assigned for security fixes. Given that these patches address
> an HMAC bypass and an unchecked memcpy, would these qualify for CVE assignment
> once merged, or is that at the discretion of the CVE team?
> 
> Thanks,
> Sanket Sharma
> sanketsharmacsec@xxxxxxxxx

1. Please use plain text and avoid top-posting:
   https://docs.kernel.org/process/email-clients.html
2. I asked to not document assumed attack scenarios to the commit
   message. It is not useful information to log.

> 
> On Fri, Aug 28, 2026 at 1:08 PM Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
> 
>     On Fri, Aug 28, 2026 at 01:00:11PM +0530, sanket sharma wrote:
>     > Hi Team,
>     >
>     > Thank you both for the review feedback all points have been addressed in
>     > the latest versions.
>     >
>     > One quick question: once the patches are merged, will a CVE be assigned
>     > automatically by the kernel CVE team, or do I need to separately request
>     > one via security@xxxxxxxxxx?
> 
>     <formletter>
> 
>     Please see:
>             https://www.kernel.org/doc/html/latest/process/cve.html
>     for how kernel CVEs are assigned.
> 
>     </formletter>
> 

BR, Jarkko