|
 |
5c11a9 |
From 324dbb4c27ae789c73b69dbf4611242267919dd4 Mon Sep 17 00:00:00 2001
|
|
|
5c11a9 |
From: Stefan Berger <stefanb@linux.ibm.com>
|
|
|
5c11a9 |
Date: Mon, 20 Feb 2023 14:41:10 -0500
|
|
|
5c11a9 |
Subject: [PATCH] tpm2: Check size of buffer before accessing it (CVE-2023-1017
|
|
|
5c11a9 |
& -1018)
|
|
|
5c11a9 |
|
|
|
5c11a9 |
Check that there are sufficient bytes in the buffer before reading the
|
|
|
5c11a9 |
cipherSize from it. Also, reduce the bufferSize variable by the number
|
|
|
5c11a9 |
of bytes that make up the cipherSize to avoid reading and writing bytes
|
|
|
5c11a9 |
beyond the buffer in subsequent steps that do in-place decryption.
|
|
|
5c11a9 |
|
|
|
5c11a9 |
This fixes CVE-2023-1017 & CVE-2023-1018.
|
|
|
5c11a9 |
|
|
|
5c11a9 |
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
|
|
|
5c11a9 |
---
|
|
|
5c11a9 |
src/tpm2/CryptUtil.c | 6 ++++++
|
|
|
5c11a9 |
1 file changed, 6 insertions(+)
|
|
|
5c11a9 |
|
|
|
5c11a9 |
diff --git a/src/tpm2/CryptUtil.c b/src/tpm2/CryptUtil.c
|
|
|
5c11a9 |
index 002fde0..8fae5b6 100644
|
|
|
5c11a9 |
--- a/src/tpm2/CryptUtil.c
|
|
|
5c11a9 |
+++ b/src/tpm2/CryptUtil.c
|
|
|
5c11a9 |
@@ -830,6 +830,10 @@ CryptParameterDecryption(
|
|
|
5c11a9 |
+ sizeof(session->sessionKey.t.buffer)));
|
|
|
5c11a9 |
TPM2B_HMAC_KEY key; // decryption key
|
|
|
5c11a9 |
UINT32 cipherSize = 0; // size of cipher text
|
|
|
5c11a9 |
+
|
|
|
5c11a9 |
+ if (leadingSizeInByte > bufferSize)
|
|
|
5c11a9 |
+ return TPM_RC_INSUFFICIENT;
|
|
|
5c11a9 |
+
|
|
|
5c11a9 |
// Retrieve encrypted data size.
|
|
|
5c11a9 |
if(leadingSizeInByte == 2)
|
|
|
5c11a9 |
{
|
|
|
5c11a9 |
@@ -837,6 +841,7 @@ CryptParameterDecryption(
|
|
|
5c11a9 |
// data to be decrypted
|
|
|
5c11a9 |
cipherSize = (UINT32)BYTE_ARRAY_TO_UINT16(buffer);
|
|
|
5c11a9 |
buffer = &buffer[2]; // advance the buffer
|
|
|
5c11a9 |
+ bufferSize -= 2;
|
|
|
5c11a9 |
}
|
|
|
5c11a9 |
#ifdef TPM4B
|
|
|
5c11a9 |
else if(leadingSizeInByte == 4)
|
|
|
5c11a9 |
@@ -844,6 +849,7 @@ CryptParameterDecryption(
|
|
|
5c11a9 |
// the leading size is four bytes so get the four byte size field
|
|
|
5c11a9 |
cipherSize = BYTE_ARRAY_TO_UINT32(buffer);
|
|
|
5c11a9 |
buffer = &buffer[4]; //advance pointer
|
|
|
5c11a9 |
+ bufferSize -= 4;
|
|
|
5c11a9 |
}
|
|
|
5c11a9 |
#endif
|
|
|
5c11a9 |
else
|
|
|
5c11a9 |
--
|
|
|
5c11a9 |
2.39.2
|
|
|
5c11a9 |
|