[PATCH 2/2] tpm: sessions: bound the parameter decryption by the response size

[Guo Zihao]

tpm_buf_check_hmac_response() decrypts the parameter area of a
response for sessions with TPM2_SA_ENCRYPT set:

	len = tpm_buf_read_u16(buf, &offset_p);
	aes_prepareenckey(&auth->aes_key, auth->scratch, AES_KEY_BYTES);
	aescfb_decrypt(&auth->aes_key, &buf->data[offset_p],
		       &buf->data[offset_p], len,
		       auth->scratch + AES_KEY_BYTES);

The length is read from the response itself and never checked
against the buffer: every other size taken from a session response
is compared to tpm_buf_length(), but not this one. A TPM that
reports an oversized parameter area makes aescfb_decrypt() walk
past the end of the buffer, and since the decryption is done in
place, this both reads and writes whatever follows the received
data.

Check that the encrypted parameters fit in the response before
decrypting them.

Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---
 drivers/char/tpm/tpm2-sessions.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
index 3524c1d50..6245a6baa 100644
--- a/drivers/char/tpm/tpm2-sessions.c
+++ b/drivers/char/tpm/tpm2-sessions.c
@@ -872,6 +872,10 @@ int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,
 			  auth->scratch);
 
 		len = tpm_buf_read_u16(buf, &offset_p);
+		if (offset_p + len > tpm_buf_length(buf)) {
+			rc = -EINVAL;
+			goto out;
+		}
 		aes_prepareenckey(&auth->aes_key, auth->scratch, AES_KEY_BYTES);
 		aescfb_decrypt(&auth->aes_key, &buf->data[offset_p],
 			       &buf->data[offset_p], len,
-- 
2.50.1