Re: [BUG] security/keys: out-of-bounds in tpm2_unseal_trusted()

[Jarkko Sakkinen <jarkko@kernel.org>]

On Thu, Aug 27, 2026 at 12:42:08PM +0000, co wrote:
> We found a bug reachable in:
> 
>     path    security/keys/trusted-keys
>     crash   out-of-bounds in tpm2_unseal_trusted()
>     commit  2709dd5ae32f ("Merge tag 'sched-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
> 
> Reported-by: co+6a581c4284f721d4@bugs.sh
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
> 
>         patch.diff  https://bugs.sh/b/6a581c4284f721d4/patch.diff
>         report.md   https://bugs.sh/b/6a581c4284f721d4/report.md
> 
>     This is an open science project. The code and the full set of PoCs
>     are not public at this moment, as we intend to disclose our findings
>     in an ethical way.
> 
>     Happy to test patches. Complaints and suggestions about our work
>     are welcome at:
> 
>         cedalion@bugs.sh
> 
> == Environment =========================================================
>     Reproduced on  2709dd5ae32f ("Merge tag 'sched-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip")
>     VM setup       https://bugs.sh/b/6a581c4284f721d4/run.sh
>     config         https://bugs.sh/b/6a581c4284f721d4/config.gz
>     poc            https://bugs.sh/b/6a581c4284f721d4/repro.c
> 
> == Sanitizer Report ====================================================
> BUG: KASAN: slab-out-of-bounds in tpm2_unseal_trusted (./include/linux/unaligned.h:48 (discriminator 1) security/keys/trusted-keys/trusted_tpm2.c:408 (discriminator 1) security/keys/trusted-keys/trusted_tpm2.c:595 (discriminator 1))
> Read of size 2 at addr ffff8880125db7aa by task exploit/149
> CPU: 0 UID: 1000 PID: 149 Comm: exploit Tainted: G        W           7.2.0+ #31 PREEMPTLAZY
> Call Trace:
> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
> print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
> kasan_report (mm/kasan/report.c:595)
> tpm2_unseal_trusted (./include/linux/unaligned.h:48 (discriminator 1) security/keys/trusted-keys/trusted_tpm2.c:408 (discriminator 1) security/keys/trusted-keys/trusted_tpm2.c:595 (discriminator 1))
> trusted_tpm_unseal (security/keys/trusted-keys/trusted_tpm1.c:928)
> trusted_instantiate (security/keys/trusted-keys/trusted_core.c:196)
> __key_instantiate_and_link (security/keys/key.c:446)
> __key_create_or_update (security/keys/key.c:941)
> key_create_or_update (security/keys/key.c:1021)
> __do_sys_add_key (security/keys/keyctl.c:134)
> do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> Allocated by task 149:
> kasan_save_stack (mm/kasan/common.c:57)
> kasan_save_track (mm/kasan/common.c:78)
> __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
> __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5337 mm/slub.c:5362)
> tpm2_unseal_trusted (./include/linux/slab.h:992 security/keys/trusted-keys/trusted_tpm2.c:119 security/keys/trusted-keys/trusted_tpm2.c:384 security/keys/trusted-keys/trusted_tpm2.c:595)
> trusted_tpm_unseal (security/keys/trusted-keys/trusted_tpm1.c:928)
> trusted_instantiate (security/keys/trusted-keys/trusted_core.c:196)
> __key_instantiate_and_link (security/keys/key.c:446)
> __key_create_or_update (security/keys/key.c:941)
> key_create_or_update (security/keys/key.c:1021)
> __do_sys_add_key (security/keys/keyctl.c:134)
> do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> The buggy address belongs to the object at ffff8880125db7a0
> which belongs to the cache kmalloc-8 of size 8
> The buggy address is located 2 bytes to the right of
> allocated 8-byte region [ffff8880125db7a0, ffff8880125db7a8)
> The buggy address belongs to the physical page:
> page dumped because: kasan: bad access detected
> Memory state around the buggy address:
> ffff8880125db680: 00 fc fc fc fa fc fc fc 00 fc fc fc fc fc fc fc
> ffff8880125db700: fc fc fc fc fc fc fc fc fa fc fc fc 00 fc fc fc
> >ffff8880125db780: fc fc fc fc 00 fc fc fc fa fc fc fc fc fc fc fc
> ^
> ffff8880125db800: fc fc fc fc fa fc fc fc 07 fc fc fc fc fc fc fc
> ffff8880125db880: fa fc fc fc fc fc fc fc fc fc fc fc 00 fc fc fc
> 
> 
> ---
> The report format is based on syzbot bug report.
> 
> This report is generated by a bot. It may contain errors.
> See https://github.com/n132/cedalion for more information.
> 
> For any issue with this report, reach out to cedalion@bugs.sh
> 
> If the report is already addressed, let us know by replying with:
> #co fix: <commit hash>
> 
> If the report is a duplicate of another one, reply with:
> #co dup: <lore link>
> 
> If you want to undo deduplication, reply with:
> #co undup
> 
> 

ack as for acknowledging this. i'll look this on monday in detail
(my work week is over and i have weekend activities).

Thank you for reporting!

BR, Jarkko