Описание
In the Linux kernel, the following vulnerability has been resolved:
KEYS: trusted: Fix tpm2_load_cmd() boundary check
tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
payload->blob_len. Address this by passing the decoded blob size to
tpm2_load_cmd(), and use it for the boundary checks.
A flaw was found in the Linux kernel's trusted keys subsystem. A local user can exploit this vulnerability by submitting a specially crafted trusted key payload. Because the kernel validates boundaries against the encoded data length rather than the decoded buffer size, an out-of-bounds memory read can occur. This issue can lead to a system crash, resulting in a denial of service (DoS), or potentially expose sensitive kernel memory.
Отчет
An incorrect boundary check in the Trusted Keys TPM2 path compares offsets in a decoded key blob against payload blob_len which describes the larger ASN.1 representation. A malformed key can therefore pass validation even when private_len or public_len points beyond the allocated decoded buffer, leading to an out of bounds read in get_unaligned_be16 or later public data processing. For the CVSS the PR:L value is used because triggering requires a local process to submit a crafted Trusted Key blob through the key management interface, while full administrative privileges are not proven to be universally required. The issue is not network reachable through this code path. Impact is at least a possible local denial of service through an invalid kernel memory read, while the paranoid assessment also considers limited confidentiality impact if adjacent kernel data is copied into a TPM command or otherwise becomes observable. No integrity impact is assigned because the available code establishes an out of bounds read but not an out of bounds write or arbitrary write primitive.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2_load_cmd() boundary check tpm2_load_cmd() does boundary checks against the ASN.1 size i.e., payload->blob_len. Address this by passing the decoded blob size to tpm2_load_cmd(), and use it for the boundary checks.
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2_load_cmd() boundary check tpm2_load_cmd() does boundary checks against the ASN.1 size i.e., payload->blob_len. Address this by passing the decoded blob size to tpm2_load_cmd(), and use it for the boundary checks.
In the Linux kernel, the following vulnerability has been resolved: K ...
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2_load_cmd() boundary check tpm2_load_cmd() does boundary checks against the ASN.1 size i.e., payload->blob_len. Address this by passing the decoded blob size to tpm2_load_cmd(), and use it for the boundary checks.
EPSS
5.5 Medium
CVSS3