Signed/unsigned confusion in tpm_tis12_write causes stack buffer over-read on zero-length write
Summary
tpm.c:1273 n = MIN(sizeof(buf), uio->uio_resid) -> n=0 for write(fd,buf,0). 1284 tpm_tis12_write(sc, buf, 0) NO early return. 820-825 while (cnt < len-1) where cnt is size_t and len is int; len=0 -> len-1=-1 -> promoted to SIZE_MAX -> loop unbounded. *p++ derefs uninitialized stack buf[TPM_BUFSIZ=1024] writing to TPM_DATA FIFO. Over-reads kernel stack -> info leak to TPM hardware + potential panic on guard page. /dev/tpm mode 0600 root:wheel. Fix: if(len<=0) return EINVAL in tpm_tis12_write + if(uio_resid==0) return 0 in tpmwrite.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1597 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 337 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 705 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1597 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: tpm.c:1273 n = MIN(sizeof(buf), uio->uio_resid) -> n=0 for write(fd,buf,0). 1284 tpm_tis12_write(sc, buf, 0) NO early return. 820-825 while (cnt < len-1) where cnt is size_t and len is int; len=0 -> l
Citation: sys/dev/crypto/tpm/tpm.c:821-1284
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: size_t cnt < int len-1 wraps to SIZE_MAX when len=0 (tpm.c:807-822)
Verified recommended fix
Source-confirmed: size_t cnt < int len-1 wraps to SIZE_MAX when len=0 (tpm.c:807-822)
Verdict
Source-confirmed: size_t cnt < int len-1 wraps to SIZE_MAX when len=0 (tpm.c:807-822)
No comments yet.