On Tue, Aug 25, 2026 at 06:29:18PM +0000, sn0x-sharma wrote: > tpm_seal() computes storedsize from TPM response fields and passes > it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds > validation. A forged TPM response can set storedsize to 4086, > overflowing the 512-byte blob by 3574 bytes into adjacent slab > objects. > > Add a check that storedsize does not exceed MAX_BLOB_SIZE before > the memcpy, returning -EINVAL on oversized responses. > > Reported-by: sn0x-sharma <[email protected]> > Link: https://lore.kernel.org/linux-integrity/
That's not a valid link :( > Signed-off-by: sn0x-sharma <[email protected]> No need for a reported-by: if you author and sign off on the patch. And we need a real name please, not an alias. thanks, greg k-h
