[PATCH v2 1/2] tpm: sessions: bound the primary public area by the response size

[Guo Zihao]

tpm2_parse_create_primary() reads the size of the TPM2B_PUBLIC area
from the response and hashes it to compute the object name:

	len = tpm_buf_read_u16(buf, &offset_r);
	offset_t = offset_r;
	if (name) {
		/*
		 * now we have the public area, compute the name of
		 * the object
		 */
		put_unaligned_be16(TPM_ALG_SHA256, name);
		sha256(&buf->data[offset_r], len, name + 2);
	}

The length is only checked against the response later, after the
hash has been taken. A TPM that reports a public area longer than
what it actually sent makes the sha256() run past the end of the
received data and hash whatever follows the response in the buffer.

Check that the public area fits in the response before hashing it.

Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---

v2: Drop the Fixes and Cc: stable tags, as suggested by Jarkko
Sakkinen: a TPM reporting an oversized public area is not known
to violate the TCG specification, so this is hardening rather
than a bug fix. No code changes.

 drivers/char/tpm/tpm2-sessions.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
index cf8f1fd6790b..e140079dbc13 100644
--- a/drivers/char/tpm/tpm2-sessions.c
+++ b/drivers/char/tpm/tpm2-sessions.c
@@ -1125,6 +1125,8 @@ static int tpm2_parse_create_primary(struct tpm_chip *chip, struct tpm_buf *buf,
 		return -EINVAL;
 	len = tpm_buf_read_u16(buf, &offset_r);
 	offset_t = offset_r;
+	if (offset_r + len > tpm_buf_length(buf))
+		return -EINVAL;
 	if (name) {
 		/*
 		 * now we have the public area, compute the name of
-- 
2.50.1