In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tpm: Make the TPM character devices non-seekable<\/p>\n
The TPM character devices expose a sequential command\/response
\ninterface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
\nenabled.<\/p>\n
After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
\npasses 0x1400 as *off to tpm_common_read(). The transfer length is
\nbounded by response_length, but the offset is used unchecked when
\nforming data_buffer + *off. A sufficiently large offset therefore causes
\nan out-of-bounds heap read through copy_to_user() and, if the copy
\nsucceeds, an out-of-bounds zero-write through the following memset().<\/p>\n
Positional I\/O does not provide coherent semantics for this interface.
\nAn arbitrary pread offset cannot represent how much of a response has
\nbeen consumed sequentially. The write callback always stores a command
\nat the start of data_buffer, while pwrite() does not update file->f_pos
\nand can leave the sequential read cursor stale.<\/p>\n
Call nonseekable_open() from both open handlers. This removes
\nFMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
\nfail with -ESPIPE before reaching the TPM callbacks, and explicitly
\nmarks the files non-seekable. Normal read() and write() continue to use
\nthe existing sequential f_pos cursor, leaving the response state machine
\nunchanged.<\/p>\n
Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:<\/p>\n
– sequential partial reads returned the complete response
\n – pread() and preadv() with offset 0x1400 returned -ESPIPE
\n – pwrite() and pwritev() with offset zero returned -ESPIPE
\n – the pending response remained intact after the rejected operations
\n – a subsequent normal command\/response cycle completed normally
\n – no KASAN report was produced.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tpm: Make the TPM character devices non-seekable<\/p>\n
The TPM character devices expose a sequential command\/response
\ninterface, but the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6797","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6797"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6797"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}