diff --git a/SOURCES/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch b/SOURCES/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch new file mode 100644 index 0000000..d39b0fb --- /dev/null +++ b/SOURCES/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch @@ -0,0 +1,37 @@ +From e4261984374556da65c9d46097d5a1200b335c0c Mon Sep 17 00:00:00 2001 +From: Juergen Repp +Date: Sat, 19 Feb 2022 12:59:32 +0100 +Subject: [PATCH] tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for + label of size 0 (OSSL 3) + +Openssl 3.0 did return an error if EVP_PKEY_CTX_set0_rsa_oaep_label was called +with label size 0. The function should only be called if the size of the label +is greater 0. +With this fix TPM2_RSA_Encrypt/Decrypt did work with OpenSSL 1.1 and 3.0 +for encryption without label. + +Signed-off-by: Juergen Repp +--- + src/tpm2/crypto/openssl/CryptRsa.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/tpm2/crypto/openssl/CryptRsa.c b/src/tpm2/crypto/openssl/CryptRsa.c +index 4ed04384feb0..b5d6b6c3be82 100644 +--- a/src/tpm2/crypto/openssl/CryptRsa.c ++++ b/src/tpm2/crypto/openssl/CryptRsa.c +@@ -1356,10 +1356,9 @@ CryptRsaEncrypt( + if (tmp == NULL) + ERROR_RETURN(TPM_RC_FAILURE); + memcpy(tmp, label->buffer, label->size); ++ if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0) ++ ERROR_RETURN(TPM_RC_FAILURE); + } +- // label->size == 0 is supported +- if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0) +- ERROR_RETURN(TPM_RC_FAILURE); + tmp = NULL; + break; + default: +-- +2.36.0.44.g0f828332d5ac + diff --git a/SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch b/SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch new file mode 100644 index 0000000..a886ee8 --- /dev/null +++ b/SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch @@ -0,0 +1,31 @@ +From 3d2bbe2f1947784506ba0a7f9e8ab81eefb69929 Mon Sep 17 00:00:00 2001 +From: Ross Lagerwall +Date: Mon, 23 May 2022 14:16:57 +0100 +Subject: [PATCH] tpm2: Fix size check in CryptSecretDecrypt + +Check the secret size against the size of the buffer, not the size +member that has not been set yet. + +Reported by Coverity. + +Signed-off-by: Ross Lagerwall +--- + src/tpm2/CryptUtil.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/tpm2/CryptUtil.c b/src/tpm2/CryptUtil.c +index 9879f918acb6..002fde0987a9 100644 +--- a/src/tpm2/CryptUtil.c ++++ b/src/tpm2/CryptUtil.c +@@ -732,7 +732,7 @@ CryptSecretDecrypt( + nonceCaller->t.size); + } + // make sure secret will fit +- if(secret->t.size > data->t.size) ++ if(secret->t.size > sizeof(data->t.buffer)) + return TPM_RC_FAILURE; + data->t.size = secret->t.size; + // CFB decrypt, using nonceCaller as iv +-- +2.36.0.44.g0f828332d5ac + diff --git a/SOURCES/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch b/SOURCES/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch new file mode 100644 index 0000000..59aaacc --- /dev/null +++ b/SOURCES/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch @@ -0,0 +1,51 @@ +From b662e6fd7169f31ef664ecd0b0b45547462e1e31 Mon Sep 17 00:00:00 2001 +From: Stefan Berger +Date: Tue, 4 Jan 2022 14:45:31 -0500 +Subject: [PATCH] tpm2: When writing state initialize s_ContextSlotMask if not + set + +If s_ContextSlotMask was not set since the TPM 2 was not initialized +by a call to TPM_Manufacture() or the state was not resumed, then +initialize the s_ContextSlotMask to 0xffff. + +This situation can occur if a VM with an attached swtpm was started +and the VM's firmware either doesn't support TPM or didn't get to +initialize the vTPM. + +The following commands recreated the issue with a SeaBIOS-only VM that +had no attached hard disk but an attached TPM 2: + +virsh start BIOS-only-VM ; virsh save BIOS-only-VM save.bin ; \ + virsh restore save.bin + +Error: Failed to restore domain from save.bin +error: internal error: qemu unexpectedly closed the monitor: \ +2022-01-04T19:26:18.835851Z qemu-system-x86_64: tpm-emulator: Setting the stateblob (type 2) failed with a TPM error 0x3 a parameter is bad +2022-01-04T19:26:18.835899Z qemu-system-x86_64: error while loading state for instance 0x0 of device 'tpm-emulator' +2022-01-04T19:26:18.835929Z qemu-system-x86_64: load of migration failed: Input/output error + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2035731 +Signed-off-by: Stefan Berger +--- + src/tpm2/NVMarshal.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c +index 996c73c..c7cd1e0 100644 +--- a/src/tpm2/NVMarshal.c ++++ b/src/tpm2/NVMarshal.c +@@ -1422,6 +1422,11 @@ STATE_RESET_DATA_Marshal(STATE_RESET_DATA *data, BYTE **buffer, INT32 *size) + written += UINT16_Marshal(&array_size, buffer, size); + for (i = 0; i < array_size; i++) + written += UINT16_Marshal(&data->contextArray[i], buffer, size); ++ ++ if (s_ContextSlotMask != 0x00ff && s_ContextSlotMask != 0xffff) { ++ /* TPM wasn't initialized, so s_ContextSlotMask wasn't set */ ++ s_ContextSlotMask = 0xffff; ++ } + written += UINT16_Marshal(&s_ContextSlotMask, buffer, size); + + written += UINT64_Marshal(&data->contextCounter, buffer, size); +-- +2.36.1 + diff --git a/SPECS/libtpms.spec b/SPECS/libtpms.spec index 95562a5..bf4da0e 100644 --- a/SPECS/libtpms.spec +++ b/SPECS/libtpms.spec @@ -3,12 +3,15 @@ Name: libtpms Version: 0.9.1 -Release: 0.%{gitdate}git%{gitversion}%{?dist} +Release: 2.%{gitdate}git%{gitversion}%{?dist} Summary: Library providing Trusted Platform Module (TPM) functionality License: BSD Url: http://github.com/stefanberger/libtpms Source0: libtpms-%{gitdate}.tar.xz +Patch0001: 0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch +Patch0002: 0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch +Patch0003: 0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch BuildRequires: openssl-devel BuildRequires: pkgconfig gawk sed @@ -55,6 +58,14 @@ find %{buildroot} -type f -name '*.la' | xargs rm -f -- || : %{_mandir}/man3/* %changelog +* Mon Jun 20 2022 Marc-André Lureau - 0.9.1-2.20211126git1ff6fe1f43 +- Backport s_ContextSlotMask initialization fix + Resolves: rhbz#2035731 + +* Mon Jun 13 2022 Marc-André Lureau - 0.9.1-1.20211126git1ff6fe1f43 +- Backport RSA/OAEP fixes. + Resolves: rhbz#2093651 + * Wed Dec 01 2021 Marc-André Lureau - 0.9.1-0.20211126git1ff6fe1f43 - Rebase to 0.9.1 Resolves: rhbz#2027951