rpms/gnupg2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-24882

Browse Source 
Resolves: RHEL-144668
This commit is contained in:
Jakub Jelen 2026-02-06 14:34:48 +01:00
parent f00f0afb15
commit 07b05a785c
2 changed files with 66 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
gnupg-2.4.5-tpm2daemon.patch Normal file
View File

@ -0,0 +1,62 @@
From 93fa34d9a346020355cd51d54102d30d4f177323 Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Mon, 26 Jan 2026 11:13:44 +0100
Subject: [PATCH] tpm: Fix possible buffer overflow in PKDECRYPT
* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT.
(tpm2_rsa_decrypt): Ditto.
--
GnuPG-bug-id: 8045
Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
Reported-by: OpenAI Security Research
---
tpm2d/tpm2.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c
index a4677fb98..282de5e5d 100644
--- a/tpm2d/tpm2.c
+++ b/tpm2d/tpm2.c
@@ -951,10 +951,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
size_t len;
int ret;
+#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */
+ if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1)
+ return GPG_ERR_TOO_LARGE;
+#elif defined(MAX_ECC_KEY_BYTES) /* IBM stack */
+ if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1)
+ return GPG_ERR_TOO_LARGE;
+#else
+# error TMP2 header are not correctly installed
+#endif
+
/* This isn't really a decryption per se. The ciphertext actually
* contains an EC Point which we must multiply by the private key number.
*
- * The reason is to generate a diffe helman agreement on a shared
+ * The reason is to generate a diffie-hellman agreement on a shared
* point. This shared point is then used to generate the per
* session encryption key.
*/
@@ -1010,6 +1020,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
TPM_HANDLE ah;
char *auth;
+#if defined(TPM2_MAX_RSA_KEY_BYTES) /* Intel stack */
+ if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES)
+ return GPG_ERR_TOO_LARGE;
+#elif defined(MAX_RSA_KEY_BYTES) /* IBM stack */
+ if (ciphertext_len > MAX_RSA_KEY_BYTES)
+ return GPG_ERR_TOO_LARGE;
+#else
+# error TMP2 header are not correctly installed
+#endif
+
inScheme.scheme = TPM_ALG_RSAES;
/*
* apparent gcrypt error: occasionally rsa ciphertext will
--
2.52.0

4
gnupg2.spec
View File

@ -34,6 +34,9 @@ Patch34: gnupg-2.4.5-revert-default-eddsa.patch
Patch35: gnupg-2.4.5-sast.patch
# https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9
Patch36: gnupg-2.4.5-memcpy.patch
# CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution
# https://dev.gnupg.org/T8045
Patch37: gnupg-2.4.5-tpm2daemon.patch
URL: https://www.gnupg.org/
@ -130,6 +133,7 @@ to the base GnuPG package
%patch 34 -p1 -R -b .eddsa
%patch 35 -p1 -b .sast
%patch 36 -p1 -b .memcpy
%patch 37 -p1 -b .tpm2d
# pcsc-lite library major: 0 in 1.2.0, 1 in 1.2.9+ (dlopen()'d in pcsc-wrapper)
# Note: this is just the name of the default shared lib to load in scdaemon,