lkml.org 
[lkml]   [2011]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[036/101] TPM: Call tpm_transmit with correct size
    2.6.33-longterm review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Peter Huewe <huewe.external.infineon@googlemail.com>

    commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 upstream.

    This patch changes the call of tpm_transmit by supplying the size of the
    userspace buffer instead of TPM_BUFSIZE.

    This got assigned CVE-2011-1161.

    [The first hunk didn't make sense given one could expect
    way less data than TPM_BUFSIZE, so added tpm_transmit boundary
    check over bufsiz instead
    The last parameter of tpm_transmit() reflects the amount
    of data expected from the device, and not the buffer size
    being supplied to it. It isn't ideal to parse it directly,
    so we just set it to the maximum the input buffer can handle
    and let the userspace API to do such job.]

    Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
    Signed-off-by: James Morris <jmorris@namei.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/char/tpm/tpm.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/drivers/char/tpm/tpm.c
    +++ b/drivers/char/tpm/tpm.c
    @@ -374,6 +374,9 @@ static ssize_t tpm_transmit(struct tpm_c
    u32 count, ordinal;
    unsigned long stop;

    + if (bufsiz > TPM_BUFSIZE)
    + bufsiz = TPM_BUFSIZE;
    +
    count = be32_to_cpu(*((__be32 *) (buf + 2)));
    ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
    if (count == 0)



    \
     
     \ /
      Last update: 2011-11-03 02:53    [W:0.020 / U:33.440 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site