On Tue, Aug 25, 2026 at 06:29:19PM +0000, sn0x-sharma wrote: > TSS_checkhmac1() and TSS_checkhmac2() silently return success when the > response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC > verification entirely. A forged TPM response with this unauthenticated > tag allows an attacker to skip integrity checks on TPM responses. > > Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring > all responses to carry a proper authenticated tag. > > Reported-by: sn0x-sharma <[email protected]>
SOB is enough. > Link: https://lore.kernel.org/linux-integrity/ > Signed-off-by: sn0x-sharma <[email protected]> If by any means possible, use your real name here. > --- > security/keys/trusted-keys/trusted_tpm1.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/security/keys/trusted-keys/trusted_tpm1.c > b/security/keys/trusted-keys/trusted_tpm1.c > index d47cb7108..c89fc6cfe 100644 > --- a/security/keys/trusted-keys/trusted_tpm1.c > +++ b/security/keys/trusted-keys/trusted_tpm1.c > @@ -202,7 +202,7 @@ static int TSS_checkhmac1(unsigned char *buffer, > ordinal = command; > result = LOAD32N(buffer, TPM_RETURN_OFFSET); > if (tag == TPM_TAG_RSP_COMMAND) > - return 0; > + return -EINVAL; > if (tag != TPM_TAG_RSP_AUTH1_COMMAND) > return -EINVAL; > authdata = buffer + bufsize - SHA1_DIGEST_SIZE; > @@ -270,7 +270,7 @@ static int TSS_checkhmac2(unsigned char *buffer, > result = LOAD32N(buffer, TPM_RETURN_OFFSET); > > if (tag == TPM_TAG_RSP_COMMAND) > - return 0; > + return -EINVAL; > if (tag != TPM_TAG_RSP_AUTH2_COMMAND) > return -EINVAL; > authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1 > -- > 2.53.0 > otherwise looks ok BR, Jarkko
