rpms/tpm2-tools
7
0
Fork 0
Code Issues Pull Requests Releases Activity
c9s
tpm2-tools/0020-fix-tpm2_identity_util-add-buffer-size-check.patch
Štěpán Horáček 9983900131 Backport upstream fixes 
Resolves: RHEL-164795

Signed-off-by: Štěpán Horáček <shoracek@redhat.com>
2026-05-30 03:05:41 +02:00

152 lines
6.7 KiB
Diff
Raw Permalink Blame History

From 92139de454e5aecfb11bf9ccba5a5bd2e8052cc6 Mon Sep 17 00:00:00 2001
From: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
Date: Fri, 27 Mar 2026 19:15:29 +0900
Subject: [PATCH 20/20] fix(tpm2_identity_util)!: add buffer size check
hmac_outer_integrity() concatenates two caller-supplied buffers into a
fixed-size stack buffer of TPM2_MAX_DIGEST_BUFFER (1024) bytes using
memcpy without checking their combined size.
This commit adds a buffer size check before memcpy to prevent potential
oob.
To propagate errors to the caller, the return type of hmac_outer_integrity()
and tpm2_identity_util_calculate_outer_integrity() from void to bool.
The latter change breaks compatibility with the public API.
Signed-off-by: Takuma IMAMURA <209989118+hyperfinitism@users.noreply.github.com>
---
lib/tpm2_identity_util.c | 15 ++++++++++++---
lib/tpm2_identity_util.h | 2 +-
tools/tpm2_duplicate.c | 5 ++++-
tools/tpm2_import.c | 5 ++++-
tools/tpm2_makecredential.c | 7 +++++--
5 files changed, 26 insertions(+), 8 deletions(-)
diff --git a/lib/tpm2_identity_util.c b/lib/tpm2_identity_util.c
index 781b34c9..759d0cd6 100644
--- a/lib/tpm2_identity_util.c
+++ b/lib/tpm2_identity_util.c
@@ -268,11 +268,18 @@ out:
return result;
}
-static void hmac_outer_integrity(TPMI_ALG_HASH parent_name_alg,
+static bool hmac_outer_integrity(TPMI_ALG_HASH parent_name_alg,
uint8_t *buffer1, uint16_t buffer1_size, uint8_t *buffer2,
uint16_t buffer2_size, uint8_t *hmac_key,
TPM2B_DIGEST *outer_integrity_hmac) {
+ if ((size_t)buffer1_size + buffer2_size > TPM2_MAX_DIGEST_BUFFER) {
+ LOG_ERR("Necessary buffer size (%u) exceeds TPM2_MAX_DIGEST_BUFFER (%zu)",
+ (unsigned)(buffer1_size + buffer2_size),
+ (size_t)TPM2_MAX_DIGEST_BUFFER);
+ return false;
+ }
+
uint8_t to_hmac_buffer[TPM2_MAX_DIGEST_BUFFER];
memcpy(to_hmac_buffer, buffer1, buffer1_size);
memcpy(to_hmac_buffer + buffer1_size, buffer2, buffer2_size);
@@ -284,6 +291,7 @@ static void hmac_outer_integrity(TPMI_ALG_HASH parent_name_alg,
to_hmac_buffer, buffer1_size + buffer2_size,
outer_integrity_hmac->buffer, &size);
outer_integrity_hmac->size = size;
+ return true;
}
bool tpm2_identity_util_calculate_inner_integrity(TPMI_ALG_HASH name_alg,
@@ -359,7 +367,7 @@ bool tpm2_identity_util_calculate_inner_integrity(TPMI_ALG_HASH name_alg,
encrypted_inner_integrity);
}
-void tpm2_identity_util_calculate_outer_integrity(TPMI_ALG_HASH parent_name_alg,
+bool tpm2_identity_util_calculate_outer_integrity(TPMI_ALG_HASH parent_name_alg,
TPM2B_NAME *pubname, TPM2B_MAX_BUFFER *marshalled_sensitive,
TPM2B_MAX_BUFFER *protection_hmac_key,
TPM2B_MAX_BUFFER *protection_enc_key, TPMT_SYM_DEF_OBJECT *sym_alg,
@@ -373,7 +381,8 @@ void tpm2_identity_util_calculate_outer_integrity(TPMI_ALG_HASH parent_name_alg,
marshalled_sensitive->buffer, marshalled_sensitive->size,
NULL, 0, encrypted_duplicate_sensitive);
//Calculate outerHMAC
- hmac_outer_integrity(parent_name_alg, encrypted_duplicate_sensitive->buffer,
+ return hmac_outer_integrity(parent_name_alg,
+ encrypted_duplicate_sensitive->buffer,
encrypted_duplicate_sensitive->size, pubname->name, pubname->size,
protection_hmac_key->buffer, outer_hmac);
}
diff --git a/lib/tpm2_identity_util.h b/lib/tpm2_identity_util.h
index c298a62f..31ba6e6e 100644
--- a/lib/tpm2_identity_util.h
+++ b/lib/tpm2_identity_util.h
@@ -95,7 +95,7 @@ bool tpm2_identity_util_calculate_inner_integrity(TPMI_ALG_HASH name_alg,
* @param outer_hmac
* The outer HMAC structure to populate.
*/
-void tpm2_identity_util_calculate_outer_integrity(TPMI_ALG_HASH parent_name_alg,
+bool tpm2_identity_util_calculate_outer_integrity(TPMI_ALG_HASH parent_name_alg,
TPM2B_NAME *pubname, TPM2B_MAX_BUFFER *marshalled_sensitive,
TPM2B_MAX_BUFFER *protection_hmac_key,
TPM2B_MAX_BUFFER *protection_enc_key, TPMT_SYM_DEF_OBJECT *sym_alg,
diff --git a/tools/tpm2_duplicate.c b/tools/tpm2_duplicate.c
index b64e8fcb..88a70f95 100644
--- a/tools/tpm2_duplicate.c
+++ b/tools/tpm2_duplicate.c
@@ -315,10 +315,13 @@ static tool_rc tpm2_create_duplicate(
*/
TPM2B_DIGEST outer_hmac = TPM2B_EMPTY_INIT;
TPM2B_MAX_BUFFER encrypted_duplicate_sensitive = TPM2B_EMPTY_INIT;
- tpm2_identity_util_calculate_outer_integrity(parent_pub->publicArea.nameAlg,
+ bool outer_res = tpm2_identity_util_calculate_outer_integrity(parent_pub->publicArea.nameAlg,
&pubname, &marshalled_sensitive, &hmac_key, &enc_key,
&parent_pub->publicArea.parameters.rsaDetail.symmetric,
&encrypted_duplicate_sensitive, &outer_hmac);
+ if (!outer_res) {
+ return tool_rc_general_error;
+ }
/*
* Build the private data structure for writing out
diff --git a/tools/tpm2_import.c b/tools/tpm2_import.c
index 3a8c5c34..b7b1687e 100644
--- a/tools/tpm2_import.c
+++ b/tools/tpm2_import.c
@@ -155,10 +155,13 @@ static tool_rc key_import(ESYS_CONTEXT *ectx, TPM2B_PUBLIC *parent_pub,
TPM2B_DIGEST outer_hmac = TPM2B_EMPTY_INIT;
TPM2B_MAX_BUFFER encrypted_duplicate_sensitive = TPM2B_EMPTY_INIT;
- tpm2_identity_util_calculate_outer_integrity(parent_pub->publicArea.nameAlg,
+ bool outer_res = tpm2_identity_util_calculate_outer_integrity(parent_pub->publicArea.nameAlg,
&pubname, &encrypted_inner_integrity, &hmac_key, &enc_key,
&parent_pub->publicArea.parameters.rsaDetail.symmetric,
&encrypted_duplicate_sensitive, &outer_hmac);
+ if (!outer_res) {
+ return tool_rc_general_error;
+ }
TPM2B_PRIVATE private = TPM2B_EMPTY_INIT;
res = create_import_key_private_data(&private, parent_pub->publicArea.nameAlg,
diff --git a/tools/tpm2_makecredential.c b/tools/tpm2_makecredential.c
index 2a3d137a..dc1cb5e8 100644
--- a/tools/tpm2_makecredential.c
+++ b/tools/tpm2_makecredential.c
@@ -137,10 +137,13 @@ static tool_rc make_external_credential_and_save(void) {
*/
TPM2B_DIGEST outer_hmac = TPM2B_EMPTY_INIT;
TPM2B_MAX_BUFFER encrypted_sensitive = TPM2B_EMPTY_INIT;
- tpm2_identity_util_calculate_outer_integrity(name_alg, &ctx.object_name,
- &marshalled_inner_integrity, &hmac_key, &enc_key,
+ bool outer_res = tpm2_identity_util_calculate_outer_integrity(name_alg,
+ &ctx.object_name, &marshalled_inner_integrity, &hmac_key, &enc_key,
&ctx.public.publicArea.parameters.rsaDetail.symmetric,
&encrypted_sensitive, &outer_hmac);
+ if (!outer_res) {
+ return tool_rc_general_error;
+ }
/*
* Package up the info to save
--
2.54.0
Reference in New Issue View Git Blame Copy Permalink