A TPM reply's length is taken from the device and only upper-capped, then several callers use it unchecked: the TPM1 OIAP helpers and the TPM2 GetCapability parser subtract a fixed header length from it, so a reply too short underflows the subtraction into a huge memcpy; the GetCapability parser then copies that many bytes into the caller's buffer, so a reply longer than the buffer overruns it. Because a TPM sits on a physically accessible bus, a cheap bus interposer (the kind used to sniff disk-encryption keys) can inject such a reply, and on the TPM2 path this parsing runs during measured boot, which is exactly the physical attacker that measured boot is meant to resist.
Patch 1 checks the reported length once in tpm_sendrecv_command(), so every command that reads a reply rejects a too-short response, and keeps a buffer bound on the GetCapability properties query. Patch 2 adds regression tests driving the parser with a truncated and an over-long reply through the sandbox emulator. Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request. Signed-off-by: Shahriyar Jalayeri <[email protected]> --- Changes in v3: - Rework per review: check the response length once in tpm_sendrecv_command() instead of at each call site, so every command that reads a reply is guarded. Drop the per-site lower-bound checks; keep the GetCapability buffer bound. - Drop Miquel's Acked-by, as the fix changed substantially. Changes in v2: - Use my real name in the From and Signed-off-by (Miquel Raynal) --- Shahriyar Jalayeri (2): tpm: bounds-check the device-reported response length test: tpm: check malformed capability responses are rejected drivers/tpm/tpm2_tis_sandbox.c | 28 ++++++++++++++++++++ include/tpm-v2.h | 10 +++++++ lib/tpm-common.c | 16 +++++++++--- lib/tpm-utils.h | 8 +++++- lib/tpm-v1.c | 59 +++++++++++++++++++++++++----------------- lib/tpm-v2.c | 52 ++++++++++++++++++++++--------------- test/dm/tpm.c | 42 ++++++++++++++++++++++++++++++ 7 files changed, 166 insertions(+), 49 deletions(-) --- base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1 change-id: 20260723-tpm-trunc-resp-664a3babf1cf Best regards, -- Shahriyar Jalayeri <[email protected]>
