[PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[sn0x-sharma]

tpm_seal() computes storedsize from TPM response fields and passes
it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
validation. A forged TPM response can set storedsize to 4086,
overflowing the 512-byte blob by 3574 bytes into adjacent slab
objects.

Add a check that storedsize does not exceed MAX_BLOB_SIZE before
the memcpy, returning -EINVAL on oversized responses.

Reported-by: sn0x-sharma <sanketsharmacsec@gmail.com>
Link: https://lore.kernel.org/linux-integrity/
Signed-off-by: sn0x-sharma <sanketsharmacsec@gmail.com>
---
 security/keys/trusted-keys/trusted_tpm1.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
index 8f57c6111..d47cb7108 100644
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c
@@ -531,6 +531,10 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
 
 	/* copy the returned blob to caller */
 	if (!ret) {
+		if (storedsize > MAX_BLOB_SIZE) {
+			ret = -EINVAL;
+			goto out;
+		}
 		memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
 		*bloblen = storedsize;
 	}
-- 
2.53.0

[PATCH 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2

[sn0x-sharma]

TSS_checkhmac1() and TSS_checkhmac2() silently return success when the
response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC
verification entirely. A forged TPM response with this unauthenticated
tag allows an attacker to skip integrity checks on TPM responses.

Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring
all responses to carry a proper authenticated tag.

Reported-by: sn0x-sharma <sanketsharmacsec@gmail.com>
Link: https://lore.kernel.org/linux-integrity/
Signed-off-by: sn0x-sharma <sanketsharmacsec@gmail.com>
---
 security/keys/trusted-keys/trusted_tpm1.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
index d47cb7108..c89fc6cfe 100644
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c
@@ -202,7 +202,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
 	ordinal = command;
 	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
 	if (tag == TPM_TAG_RSP_COMMAND)
-		return 0;
+		return -EINVAL;
 	if (tag != TPM_TAG_RSP_AUTH1_COMMAND)
 		return -EINVAL;
 	authdata = buffer + bufsize - SHA1_DIGEST_SIZE;
@@ -270,7 +270,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
 	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
 
 	if (tag == TPM_TAG_RSP_COMMAND)
-		return 0;
+		return -EINVAL;
 	if (tag != TPM_TAG_RSP_AUTH2_COMMAND)
 		return -EINVAL;
 	authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1
-- 
2.53.0

Re: [PATCH 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2

[Jarkko Sakkinen]

On Tue, Aug 25, 2026 at 06:29:19PM +0000, sn0x-sharma wrote:
> TSS_checkhmac1() and TSS_checkhmac2() silently return success when the
> response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC
> verification entirely. A forged TPM response with this unauthenticated
> tag allows an attacker to skip integrity checks on TPM responses.
> 
> Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring
> all responses to carry a proper authenticated tag.
> 
> Reported-by: sn0x-sharma <sanketsharmacsec@gmail.com>

SOB is enough.

> Link: https://lore.kernel.org/linux-integrity/
> Signed-off-by: sn0x-sharma <sanketsharmacsec@gmail.com>

If by any means possible, use your real name here.

> ---
>  security/keys/trusted-keys/trusted_tpm1.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
> index d47cb7108..c89fc6cfe 100644
> --- a/security/keys/trusted-keys/trusted_tpm1.c
> +++ b/security/keys/trusted-keys/trusted_tpm1.c
> @@ -202,7 +202,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
>  	ordinal = command;
>  	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
>  	if (tag == TPM_TAG_RSP_COMMAND)
> -		return 0;
> +		return -EINVAL;
>  	if (tag != TPM_TAG_RSP_AUTH1_COMMAND)
>  		return -EINVAL;
>  	authdata = buffer + bufsize - SHA1_DIGEST_SIZE;
> @@ -270,7 +270,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
>  	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
>  
>  	if (tag == TPM_TAG_RSP_COMMAND)
> -		return 0;
> +		return -EINVAL;
>  	if (tag != TPM_TAG_RSP_AUTH2_COMMAND)
>  		return -EINVAL;
>  	authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1
> -- 
> 2.53.0
> 

otherwise looks ok

BR, Jarkko

Re: [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Greg KH]

On Tue, Aug 25, 2026 at 06:29:18PM +0000, sn0x-sharma wrote:
> tpm_seal() computes storedsize from TPM response fields and passes
> it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
> validation. A forged TPM response can set storedsize to 4086,
> overflowing the 512-byte blob by 3574 bytes into adjacent slab
> objects.
> 
> Add a check that storedsize does not exceed MAX_BLOB_SIZE before
> the memcpy, returning -EINVAL on oversized responses.
> 
> Reported-by: sn0x-sharma <sanketsharmacsec@gmail.com>
> Link: https://lore.kernel.org/linux-integrity/

That's not a valid link :(

> Signed-off-by: sn0x-sharma <sanketsharmacsec@gmail.com>

No need for a reported-by: if you author and sign off on the patch.

And we need a real name please, not an alias.

thanks,

greg k-h

Re: [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Jarkko Sakkinen]

On Wed, Aug 26, 2026 at 08:18:32AM +0200, Greg KH wrote:
> On Tue, Aug 25, 2026 at 06:29:18PM +0000, sn0x-sharma wrote:
> > tpm_seal() computes storedsize from TPM response fields and passes
> > it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
> > validation. A forged TPM response can set storedsize to 4086,
> > overflowing the 512-byte blob by 3574 bytes into adjacent slab
> > objects.
> > 
> > Add a check that storedsize does not exceed MAX_BLOB_SIZE before
> > the memcpy, returning -EINVAL on oversized responses.
> > 
> > Reported-by: sn0x-sharma <sanketsharmacsec@gmail.com>
> > Link: https://lore.kernel.org/linux-integrity/
> 
> That's not a valid link :(

Oops, missed this one ;-)

Should be just deleted, b4 shazam will set the link tag.

> 
> > Signed-off-by: sn0x-sharma <sanketsharmacsec@gmail.com>
> 
> No need for a reported-by: if you author and sign off on the patch.
> 
> And we need a real name please, not an alias.
> 
> thanks,
> 
> greg k-h

BR, Jarkko

Re: [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Greg KH]

On Fri, Aug 28, 2026 at 01:00:11PM +0530, sanket sharma wrote:
> Hi Team,
> 
> Thank you both for the review feedback all points have been addressed in
> the latest versions.
> 
> One quick question: once the patches are merged, will a CVE be assigned
> automatically by the kernel CVE team, or do I need to separately request
> one via security@kernel.org?

<formletter>

Please see:
        https://www.kernel.org/doc/html/latest/process/cve.html
for how kernel CVEs are assigned.

</formletter>

[PATCH v2 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Sanket Sharma]

tpm_seal() computes storedsize from TPM response fields and passes
it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
validation. A forged TPM response can set storedsize to 4086,
overflowing the 512-byte blob by 3574 bytes into adjacent slab
objects.

Add a check that storedsize does not exceed MAX_BLOB_SIZE before
the memcpy, returning -EINVAL on oversized responses.

Signed-off-by: Sanket Sharma <sanketsharmacsec@gmail.com>
---
 security/keys/trusted-keys/trusted_tpm1.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
index 8f57c6111..d47cb7108 100644
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c
@@ -531,6 +531,10 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
 
 	/* copy the returned blob to caller */
 	if (!ret) {
+		if (storedsize > MAX_BLOB_SIZE) {
+			ret = -EINVAL;
+			goto out;
+		}
 		memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
 		*bloblen = storedsize;
 	}
-- 
2.53.0

[PATCH v2 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2

[Sanket Sharma]

TSS_checkhmac1() and TSS_checkhmac2() silently return success when the
response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC
verification entirely. A forged TPM response with this unauthenticated
tag allows an attacker to skip integrity checks on TPM responses.

Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring
all responses to carry a proper authenticated tag.

Signed-off-by: Sanket Sharma <sanketsharmacsec@gmail.com>
---
 security/keys/trusted-keys/trusted_tpm1.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
index d47cb7108..c89fc6cfe 100644
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c
@@ -202,7 +202,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
 	ordinal = command;
 	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
 	if (tag == TPM_TAG_RSP_COMMAND)
-		return 0;
+		return -EINVAL;
 	if (tag != TPM_TAG_RSP_AUTH1_COMMAND)
 		return -EINVAL;
 	authdata = buffer + bufsize - SHA1_DIGEST_SIZE;
@@ -270,7 +270,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
 	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
 
 	if (tag == TPM_TAG_RSP_COMMAND)
-		return 0;
+		return -EINVAL;
 	if (tag != TPM_TAG_RSP_AUTH2_COMMAND)
 		return -EINVAL;
 	authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1
-- 
2.53.0

Re: [PATCH v2 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2

[Sudhakar Kuppusamy]

> On 26 Aug 2026, at 1:34 PM, Sanket Sharma <sanketsharmacsec@gmail.com> wrote:
> 
> TSS_checkhmac1() and TSS_checkhmac2() silently return success when the
> response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC
> verification entirely. A forged TPM response with this unauthenticated
> tag allows an attacker to skip integrity checks on TPM responses.
> 
> Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring
> all responses to carry a proper authenticated tag.
> 
> Signed-off-by: Sanket Sharma <sanketsharmacsec@gmail.com>
> ---
> security/keys/trusted-keys/trusted_tpm1.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
> index d47cb7108..c89fc6cfe 100644
> --- a/security/keys/trusted-keys/trusted_tpm1.c
> +++ b/security/keys/trusted-keys/trusted_tpm1.c
> @@ -202,7 +202,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
> ordinal = command;
> result = LOAD32N(buffer, TPM_RETURN_OFFSET);
> if (tag == TPM_TAG_RSP_COMMAND)
> - return 0;
> + return -EINVAL;

Hi Sanket Sharma,

Instead of changing the return value to -EINVAL inside the TPM_TAG_RSP_COMMAND check,
we can simplify the control flow by removing that block entirely.Since TPM_TAG_RSP_COMMAND is
inherently not equal to TPM_TAG_RSP_AUTH1_COMMAND, the subsequent mismatch check will naturally
catch it and return -EINVAL. 

Thanks,
Sudhakar

> if (tag != TPM_TAG_RSP_AUTH1_COMMAND)
> return -EINVAL;
> authdata = buffer + bufsize - SHA1_DIGEST_SIZE;
> @@ -270,7 +270,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
> result = LOAD32N(buffer, TPM_RETURN_OFFSET);
> 
> if (tag == TPM_TAG_RSP_COMMAND)
> - return 0;
> + return -EINVAL;
> if (tag != TPM_TAG_RSP_AUTH2_COMMAND)
> return -EINVAL;
> authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1
> -- 
> 2.53.0
> 
> 

Re: [PATCH v2 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Sudhakar Kuppusamy]

> On 26 Aug 2026, at 1:34 PM, Sanket Sharma <sanketsharmacsec@gmail.com> wrote:
> 
> tpm_seal() computes storedsize from TPM response fields and passes
> it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
> validation. A forged TPM response can set storedsize to 4086,
> overflowing the 512-byte blob by 3574 bytes into adjacent slab
> objects.
> 
> Add a check that storedsize does not exceed MAX_BLOB_SIZE before
> the memcpy, returning -EINVAL on oversized responses.
> 
> Signed-off-by: Sanket Sharma <sanketsharmacsec@gmail.com>

Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>


Thanks,
Sudhakar

> ---
> security/keys/trusted-keys/trusted_tpm1.c | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
> index 8f57c6111..d47cb7108 100644
> --- a/security/keys/trusted-keys/trusted_tpm1.c
> +++ b/security/keys/trusted-keys/trusted_tpm1.c
> @@ -531,6 +531,10 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
> 
> /* copy the returned blob to caller */
> if (!ret) {
> + if (storedsize > MAX_BLOB_SIZE) {
> + ret = -EINVAL;
> + goto out;
> + }
> memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
> *bloblen = storedsize;
> }
> -- 
> 2.53.0
> 
> 

[PATCH v3 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Sanket Sharma]

tpm_seal() computes storedsize from TPM response fields and passes
it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
validation. A forged TPM response can set storedsize to 4086,
overflowing the 512-byte blob by 3574 bytes into adjacent slab
objects.

Add a check that storedsize does not exceed MAX_BLOB_SIZE before
the memcpy, returning -EINVAL on oversized responses.

Signed-off-by: Sanket Sharma <sanketsharmacsec@gmail.com>
---
 security/keys/trusted-keys/trusted_tpm1.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
index 8f57c6111..d47cb7108 100644
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c
@@ -531,6 +531,10 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
 
 	/* copy the returned blob to caller */
 	if (!ret) {
+		if (storedsize > MAX_BLOB_SIZE) {
+			ret = -EINVAL;
+			goto out;
+		}
 		memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
 		*bloblen = storedsize;
 	}
-- 
2.53.0

[PATCH v3 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2

[Sanket Sharma]

TSS_checkhmac1() and TSS_checkhmac2() silently return success when the
response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC
verification entirely. A forged TPM response with this unauthenticated
tag allows an attacker to skip integrity checks on TPM responses.

Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring
all responses to carry a proper authenticated tag.

Signed-off-by: Sanket Sharma <sanketsharmacsec@gmail.com>
---
 security/keys/trusted-keys/trusted_tpm1.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
index d47cb7108..6dbbf4546 100644
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c
@@ -201,8 +201,6 @@ static int TSS_checkhmac1(unsigned char *buffer,
 	tag = LOAD16(buffer, 0);
 	ordinal = command;
 	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
-	if (tag == TPM_TAG_RSP_COMMAND)
-		return 0;
 	if (tag != TPM_TAG_RSP_AUTH1_COMMAND)
 		return -EINVAL;
 	authdata = buffer + bufsize - SHA1_DIGEST_SIZE;
@@ -269,8 +267,6 @@ static int TSS_checkhmac2(unsigned char *buffer,
 	ordinal = command;
 	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
 
-	if (tag == TPM_TAG_RSP_COMMAND)
-		return 0;
 	if (tag != TPM_TAG_RSP_AUTH2_COMMAND)
 		return -EINVAL;
 	authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1
-- 
2.53.0

Re: [PATCH v3 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2

[Jarkko Sakkinen]

On Wed, Aug 26, 2026 at 05:07:00PM +0000, Sanket Sharma wrote:
> TSS_checkhmac1() and TSS_checkhmac2() silently return success when the
> response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC
> verification entirely. A forged TPM response with this unauthenticated
> tag allows an attacker to skip integrity checks on TPM responses.

I don't think we need threat scenario role play here.

> 
> Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring
> all responses to carry a proper authenticated tag.
> 
> Signed-off-by: Sanket Sharma <sanketsharmacsec@gmail.com>
> ---
>  security/keys/trusted-keys/trusted_tpm1.c | 4 ----
>  1 file changed, 4 deletions(-)
> 
> diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
> index d47cb7108..6dbbf4546 100644
> --- a/security/keys/trusted-keys/trusted_tpm1.c
> +++ b/security/keys/trusted-keys/trusted_tpm1.c
> @@ -201,8 +201,6 @@ static int TSS_checkhmac1(unsigned char *buffer,
>  	tag = LOAD16(buffer, 0);
>  	ordinal = command;
>  	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
> -	if (tag == TPM_TAG_RSP_COMMAND)
> -		return 0;
>  	if (tag != TPM_TAG_RSP_AUTH1_COMMAND)
>  		return -EINVAL;
>  	authdata = buffer + bufsize - SHA1_DIGEST_SIZE;
> @@ -269,8 +267,6 @@ static int TSS_checkhmac2(unsigned char *buffer,
>  	ordinal = command;
>  	result = LOAD32N(buffer, TPM_RETURN_OFFSET);
>  
> -	if (tag == TPM_TAG_RSP_COMMAND)
> -		return 0;
>  	if (tag != TPM_TAG_RSP_AUTH2_COMMAND)
>  		return -EINVAL;
>  	authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1
> -- 
> 2.53.0
> 

BR, Jarkko