From: Jarkko Sakkinen <jarkko@kernel.org>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: sn0x-sharma <sanketsharmacsec@gmail.com>,
James.Bottomley@hansenpartnership.com, zohar@linux.ibm.com,
dhowells@redhat.com, linux-integrity@vger.kernel.org,
keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
security@kernel.org, w@1wt.eu
Subject: Re: [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy
Date: Fri, 28 Aug 2026 04:46:25 +0300 [thread overview]
Message-ID: <apDocVfEfwX3hFa_@kernel.org> (raw)
In-Reply-To: <2026082651-portal-valid-da58@gregkh>
On Wed, Aug 26, 2026 at 08:18:32AM +0200, Greg KH wrote:
> On Tue, Aug 25, 2026 at 06:29:18PM +0000, sn0x-sharma wrote:
> > tpm_seal() computes storedsize from TPM response fields and passes
> > it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
> > validation. A forged TPM response can set storedsize to 4086,
> > overflowing the 512-byte blob by 3574 bytes into adjacent slab
> > objects.
> >
> > Add a check that storedsize does not exceed MAX_BLOB_SIZE before
> > the memcpy, returning -EINVAL on oversized responses.
> >
> > Reported-by: sn0x-sharma <sanketsharmacsec@gmail.com>
> > Link: https://lore.kernel.org/linux-integrity/
>
> That's not a valid link :(
Oops, missed this one ;-)
Should be just deleted, b4 shazam will set the link tag.
>
> > Signed-off-by: sn0x-sharma <sanketsharmacsec@gmail.com>
>
> No need for a reported-by: if you author and sign off on the patch.
>
> And we need a real name please, not an alias.
>
> thanks,
>
> greg k-h
BR, Jarkko
next prev parent reply other threads:[~2026-08-28 1:46 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-25 18:29 sn0x-sharma
2026-08-25 18:29 ` [PATCH 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2 sn0x-sharma
2026-08-28 1:44 ` Jarkko Sakkinen
2026-08-26 6:18 ` [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy Greg KH
2026-08-28 1:46 ` Jarkko Sakkinen [this message]
[not found] ` <CAEb43b2C_eyR8ncUbJ+3MsT3ap-tB3_O0Mbaqgy1ncXwZAd_Yw@mail.gmail.com>
2026-08-28 7:36 ` Greg KH
2026-08-26 8:04 ` [PATCH v2 " Sanket Sharma
2026-08-26 8:04 ` [PATCH v2 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2 Sanket Sharma
2026-08-26 16:47 ` Sudhakar Kuppusamy
2026-08-26 16:44 ` [PATCH v2 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy Sudhakar Kuppusamy
2026-08-26 17:06 ` [PATCH v3 " Sanket Sharma
2026-08-26 17:07 ` [PATCH v3 2/2] keys: trusted: tpm1: reject unauthenticated response tag in TSS_checkhmac1/2 Sanket Sharma
2026-08-28 1:48 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apDocVfEfwX3hFa_@kernel.org \
--to=jarkko@kernel.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=dhowells@redhat.com \
--cc=gregkh@linuxfoundation.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sanketsharmacsec@gmail.com \
--cc=security@kernel.org \
--cc=w@1wt.eu \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®