Repository navigation
Backport a few patches for v0.10.3 - #613
Open
stefanberger wants to merge 10 commits into
Open
stefanberger wants to merge 10 commits into
stefanberger wants to merge 10 commits into
Conversation
Cast size_t i to ssize_t i to check for underrun. An underrun could never occur since it is not possible that all commands are disabled. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When rolling back after an unsuccessful switch to the new attributes/algorithms/commands profile, use the maximum possible StateFormatLevel value to set the old profile. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Rather than asserting, display an error log message in case an ANY_OBJECT could not be unmarshalled. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Check the untrusted array_size of AuditCommandList and PPList against a reasonable maximum value of 1024. Artificially setting BYTE buf[0xffff], which would be the maximum value array_size could get with the unmarshalling, does not cause any issues (crash due to large on-stack buffer) on my Linux system. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Limit the size of a profile to 32kb. There is no reason that a valid profile would have even close to 32kb. This also prevents issues in String_Marshal() that assumes a reasonably sized string below 64kb. Place the check for the size of the profile into GetParametersFromJSON since this function is used by RuntimeProfileSet and RuntimeProfileTest. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the
 |
| Layer / File(s) | Summary |
|---|---|
Unmarshalling validation and error handling src/tpm2/NVMarshal.c, src/tpm2/Unmarshal.c |
Unmarshal functions reject array sizes above 1024, return ANY_OBJECT_Unmarshal failures, and limit ECC key-size checks to valid non-TPM_ECC_NONE curves after successful prior validation. |
JSON profile size limit src/tpm2/RuntimeProfile_fp.h, src/tpm2/RuntimeProfile.c |
MAX_PROFILE_SIZE is defined as 32 KiB. GetParametersFromJSON rejects longer profiles before parsing. |
Profile rollback state limits src/tpm2/RuntimeAlgorithm.c, src/tpm2/RuntimeAttributes.c, src/tpm2/RuntimeCommands.c |
Profile restoration calls use ~0 for the maximum state format level. |
Enabled command index termination src/tpm2/RuntimeCommands.c |
RuntimeCommandsGetArraySize casts the reverse-loop index to ssize_t before comparison. |
Estimated code review effort: 3 (Moderate) | ~20 minutes
Merge Risk: 
14678
-
This backport adds input bounds checks, propagates unmarshalling failures, preserves prior profiles during rollback, and corrects command scanning and ECC validation gating. No concrete current-head merge-blocking risk remains.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
-
❌ Failed checks (1 warning)
Check name Status Explanation Resolution Docstring Coverage ⚠️ WarningDocstring coverage is 44.44% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 7 files. Write docstrings for the functions missing them to satisfy the coverage threshold. ✅ Passed checks (4 passed)
-
Check name Status Explanation Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled. Title check ✅ Passed The title accurately states the main change: backporting multiple patches for v0.10.3. It is concise and relevant to the six changes described. Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request. Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
-
✨ Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Create stacked PR
- Commit on current branch
🧪 Generate unit tests (beta)
-
- Create PR with unit tests
- Commit unit tests in branch
stable-0.10.next
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Check for rc == TPM_RC_SUCCESS before calling function to check whether the EC algorithm is allowed by the profile. This is necessary since rc could already have been set to TPM_RC_CURVE before. In case the function call failed, it would again be set to TPM_RC_CURVE, which is unnecessary. Also do not call the function when TPM_ECC_NONE was unmarshalled since this would always fail and unmarshalling TPM_ECC_NONE would never work. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
stefanberger
force-pushed
the
stable-0.10.next
branch
from
September 4, 2026 04:41
1467875 to
5668fde
Compare
stefanberger
force-pushed
the
stable-0.10.next
branch
from
September 11, 2026 15:28
8d14511 to
5668fde
Compare
The attributes of an OBJECT were previously at a fixed offset from the beginning of an OBJECT in the NVRAM byte array. However, since ANY_OBJECT_Marshal is now being used to write an OBJECT into the NVRAM, the offset of the OBJECT attributes may be different depending on the current StateFormatLevel and the layout of the OBJECT. Therefore, ANY_OBJECT_Unmarshal has to be used to get the attributes of an OBJECT. Fixes: #626 Reported-by: Kun Qin <kuqin12@gmail.com> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
…rypt
TPM_SymmetricKeyData_Decrypt (AES path in src/tpm12/tpm_crypto.c,
OpenSSL backend; and the NSS/FreeBL backend in
src/tpm12/tpm_crypto_freebl.c) only checked
encrypt_length < TPM_AES_BLOCK_SIZE before calling
AES_cbc_encrypt(..., AES_DECRYPT) on a buffer allocated to exactly
encrypt_length bytes. CBC decryption always consumes a whole final
block, so a length that is not a multiple of 16 makes OpenSSL read up
to 15 bytes past the end of the input buffer.
That length is TPM_CONTEXT_BLOB.sensitiveData.size from the command
stream. TPM_Process_LoadKeyContext and TPM_Process_LoadAuthContext run
under TPM_CHECK_ALLOW_NO_OWNER and decrypt the blob with the permanent
contextKey before the integrity HMAC is checked, so the over-read is
reachable with a single unauthenticated command.
Reproduced with a TPM_LoadKeyContext command whose sensitiveData.size
is 17; AddressSanitizer reports a heap over-read:
READ of size 4 ...
#0 AES_decrypt aes_core.c
#1 CRYPTO_cbc128_decrypt cbc128.c
#2 TPM_SymmetricKeyData_Decrypt tpm_crypto.c
#3 TPM_Process_LoadKeyContext tpm_session.c
The fix rejects a length that is not a whole number of blocks, the same
requirement the DES backend already enforces. The command then returns
TPM_DECRYPT_ERROR. A zero length is still rejected by TPM_Malloc().
Signed-off-by: sameera <sameera@research.itecz.au>
TPM_Sha1Context_Load() (OpenSSL backend, src/tpm12/tpm_crypto.c)
deserializes the OpenSSL SHA_CTX from a TPMLIB_SetState(VOLATILE) blob
and restores sha_ctx->num with TPM_Load32() without any range check.
num is the number of bytes buffered in sha_ctx->data and OpenSSL uses
it as the write offset in SHA1_Update()/SHA1_Final(): the update path
runs memcpy(p + num, data, SHA_CBLOCK - num). A restored num >=
SHA_CBLOCK makes SHA_CBLOCK - num wrap to a huge size_t, so the next
update writes far past the heap-allocated context, and SHA1_Final()
writes the 0x80 pad byte at p[num] well outside it.
The restored sha1_context / sha1_context_tis are later driven by the
TPM_SHA1Update command and by the host-side TPM_IO_Hash_Data(), both of
which reach TPM_SHA1UpdateCmd() -> SHA1_Update(). The volatile-state
blob is only protected by an unkeyed SHA1 integrity digest computed
after parsing, so num is attacker-controlled across a state restore.
Reproduced by loading a SHA1 context with num = 256 and then issuing
one update; AddressSanitizer reports a wrapped copy:
ERROR: AddressSanitizer: negative-size-param: (size=-192)
#0 memcpy
#1 SHA1_Update
#2 TPM_SHA1UpdateCmd tpm_crypto.c:2028
Reject num >= SHA_CBLOCK with TPM_BAD_PARAMETER and free the
partially loaded context, the same num bound the TPM 2.0 hash-state
unmarshalers already enforce. The FreeBL backend loads into a
fixed-layout struct guarded by a flatten-size check and does not
restore a write offset, so only the OpenSSL path is affected.
Signed-off-by: sameera <sameera@research.itecz.au>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport a few patches to v0.10.3.
Summary by CodeRabbit