Skip to content

Commit

Permalink
tpm2: Check size of TPM2B_NAME buffer before reading 2 bytes from it
Browse files Browse the repository at this point in the history
Fix the missing buffer size check that the TPM 2 errata v1.4 mentions in
2.6.2 by adding a buffer size check before reading 2 bytes from a
TPM2B_NAME buffer. There's no known CVE for this.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
  • Loading branch information
stefanberger committed Feb 28, 2023
1 parent 324dbb4 commit 92f470c
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions src/tpm2/EACommands.c
Original file line number Diff line number Diff line change
Expand Up @@ -892,6 +892,8 @@ TPM2_PolicyAuthorize(
// Get pointer to the session structure
session = SessionGet(in->policySession);
// Extract from the Name of the key, the algorithm used to compute it's Name
if (in->keySign.t.size < 2) // libtpms added: TPM 2 Errata v1.4
return TPM_RC_INSUFFICIENT; // libtpms added
hashAlg = BYTE_ARRAY_TO_UINT16(in->keySign.t.name);
// 'keySign' parameter needs to use a supported hash algorithm, otherwise
// can't tell how large the digest should be
Expand Down

0 comments on commit 92f470c

Please sign in to comment.