Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libtpms for openSUSE:Factory checked in at 2026-09-21 12:00:01 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libtpms (Old) and /work/SRC/openSUSE:Factory/.libtpms.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libtpms" Mon Sep 21 12:00:01 2026 rev:25 rq:1379006 version:0.10.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libtpms/libtpms.changes 2026-03-27 06:43:33.979264765 +0100 +++ /work/SRC/openSUSE:Factory/.libtpms.new.383539/libtpms.changes 2026-09-21 12:00:03.507285710 +0200 @@ -1,0 +2,7 @@ +Fri Sep 18 18:35:22 UTC 2026 - Marcus Meissner <[email protected]> + +- CVE-2026-85769: Fixed heap out-of-bounds read in TPM2 state + unmarshalling via unchecked block_skip_read() blocksize (bsc#1279628) + - libtpms-CVE-2026-85769.patch + +------------------------------------------------------------------- New: ---- libtpms-CVE-2026-85769.patch ----------(New B)---------- New: unmarshalling via unchecked block_skip_read() blocksize (bsc#1279628) - libtpms-CVE-2026-85769.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libtpms.spec ++++++ --- /var/tmp/diff_new_pack.VcM6dm/_old 2026-09-21 12:00:04.191314398 +0200 +++ /var/tmp/diff_new_pack.VcM6dm/_new 2026-09-21 12:00:04.193314482 +0200 @@ -26,6 +26,7 @@ URL: https://github.com/stefanberger/libtpms Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz Patch0: libtpms-fix-const-correctness.patch +Patch1: libtpms-CVE-2026-85769.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: fdupes ++++++ libtpms-CVE-2026-85769.patch ++++++ >From b1462888180d896af03cae0487e8d45009cc445e Mon Sep 17 00:00:00 2001 From: Stefan Berger <[email protected]> Date: Thu, 3 Sep 2026 14:47:01 -0400 Subject: [PATCH] tpm2: Add checks for *size < 0 before casting it to UINT32 Signed-off-by: Stefan Berger <[email protected]> --- src/tpm2/Unmarshal.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/tpm2/Unmarshal.c b/src/tpm2/Unmarshal.c index b75721c7..6b0a7703 100644 --- a/src/tpm2/Unmarshal.c +++ b/src/tpm2/Unmarshal.c @@ -19,7 +19,7 @@ TPM_RC UINT8_Unmarshal(UINT8 *target, BYTE **buffer, INT32 *size) { - if ((UINT32)*size < sizeof(UINT8)) { + if (*size < 0 || (UINT32)*size < sizeof(UINT8)) { return TPM_RC_INSUFFICIENT; } *target = (*buffer)[0]; @@ -37,7 +37,7 @@ INT8_Unmarshal(INT8 *target, BYTE **buffer, INT32 *size) TPM_RC UINT16_Unmarshal(UINT16 *target, BYTE **buffer, INT32 *size) { - if ((UINT32)*size < sizeof(UINT16)) { + if (*size < 0 || (UINT32)*size < sizeof(UINT16)) { return TPM_RC_INSUFFICIENT; } *target = ((UINT16)((*buffer)[0]) << 8) | @@ -50,7 +50,7 @@ UINT16_Unmarshal(UINT16 *target, BYTE **buffer, INT32 *size) TPM_RC UINT32_Unmarshal(UINT32 *target, BYTE **buffer, INT32 *size) { - if ((UINT32)*size < sizeof(UINT32)) { + if (*size < 0 || (UINT32)*size < sizeof(UINT32)) { return TPM_RC_INSUFFICIENT; } *target = ((UINT32)((*buffer)[0]) << 24) | @@ -65,7 +65,7 @@ UINT32_Unmarshal(UINT32 *target, BYTE **buffer, INT32 *size) TPM_RC UINT64_Unmarshal(UINT64 *target, BYTE **buffer, INT32 *size) { - if ((UINT32)*size < sizeof(UINT64)) { + if (*size < 0 || (UINT32)*size < sizeof(UINT64)) { return TPM_RC_INSUFFICIENT; } *target = ((UINT64)((*buffer)[0]) << 56) | @@ -86,7 +86,7 @@ Array_Unmarshal(BYTE *targetBuffer, UINT16 targetSize, BYTE **buffer, INT32 *siz { TPM_RC rc = TPM_RC_SUCCESS; - if (targetSize > *size) { + if (*size < 0 || targetSize > (UINT32)*size) { rc = TPM_RC_INSUFFICIENT; } else { -- 2.51.0
