From 07b05a785c7170421add384c401639ec4c19c5dd Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Fri, 6 Feb 2026 14:34:48 +0100
Subject: [PATCH] Fix CVE-2026-24882

Resolves: RHEL-144668
---
 gnupg-2.4.5-tpm2daemon.patch | 62 ++++++++++++++++++++++++++++++++++++
 gnupg2.spec                  |  4 +++
 2 files changed, 66 insertions(+)
 create mode 100644 gnupg-2.4.5-tpm2daemon.patch

diff --git a/gnupg-2.4.5-tpm2daemon.patch b/gnupg-2.4.5-tpm2daemon.patch
new file mode 100644
index 0000000..b1a6ad6
--- /dev/null
+++ b/gnupg-2.4.5-tpm2daemon.patch
@@ -0,0 +1,62 @@
+From 93fa34d9a346020355cd51d54102d30d4f177323 Mon Sep 17 00:00:00 2001
+From: Werner Koch <wk@gnupg.org>
+Date: Mon, 26 Jan 2026 11:13:44 +0100
+Subject: [PATCH] tpm: Fix possible buffer overflow in PKDECRYPT
+
+* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT.
+(tpm2_rsa_decrypt): Ditto.
+--
+
+GnuPG-bug-id: 8045
+Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
+Reported-by: OpenAI Security Research
+---
+ tpm2d/tpm2.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c
+index a4677fb98..282de5e5d 100644
+--- a/tpm2d/tpm2.c
++++ b/tpm2d/tpm2.c
+@@ -951,10 +951,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
+   size_t len;
+   int ret;
+ 
++#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */
++  if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1)
++    return GPG_ERR_TOO_LARGE;
++#elif defined(MAX_ECC_KEY_BYTES)    /* IBM stack */
++  if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1)
++    return GPG_ERR_TOO_LARGE;
++#else
++# error TMP2 header are not correctly installed
++#endif
++
+   /* This isn't really a decryption per se.  The ciphertext actually
+    * contains an EC Point which we must multiply by the private key number.
+    *
+-   * The reason is to generate a diffe helman agreement on a shared
++   * The reason is to generate a diffie-hellman agreement on a shared
+    * point.  This shared point is then used to generate the per
+    * session encryption key.
+    */
+@@ -1010,6 +1020,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
+   TPM_HANDLE ah;
+   char *auth;
+ 
++#if defined(TPM2_MAX_RSA_KEY_BYTES)  /* Intel stack */
++  if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES)
++    return GPG_ERR_TOO_LARGE;
++#elif defined(MAX_RSA_KEY_BYTES)     /* IBM stack */
++  if (ciphertext_len > MAX_RSA_KEY_BYTES)
++    return GPG_ERR_TOO_LARGE;
++#else
++# error TMP2 header are not correctly installed
++#endif
++
+   inScheme.scheme = TPM_ALG_RSAES;
+   /*
+    * apparent gcrypt error: occasionally rsa ciphertext will
+-- 
+2.52.0
+
diff --git a/gnupg2.spec b/gnupg2.spec
index ac993e5..b1418f4 100644
--- a/gnupg2.spec
+++ b/gnupg2.spec
@@ -34,6 +34,9 @@ Patch34: gnupg-2.4.5-revert-default-eddsa.patch
 Patch35: gnupg-2.4.5-sast.patch
 # https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9
 Patch36: gnupg-2.4.5-memcpy.patch
+# CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution
+# https://dev.gnupg.org/T8045
+Patch37:  gnupg-2.4.5-tpm2daemon.patch
 
 URL:     https://www.gnupg.org/
 
@@ -130,6 +133,7 @@ to the base GnuPG package
 %patch 34 -p1 -R -b .eddsa
 %patch 35 -p1 -b .sast
 %patch 36 -p1 -b .memcpy
+%patch 37 -p1 -b .tpm2d
 
 # pcsc-lite library major: 0 in 1.2.0, 1 in 1.2.9+ (dlopen()'d in pcsc-wrapper)
 # Note: this is just the name of the default shared lib to load in scdaemon,