Locality 0 never relinquished on any of the 9 error exits in tpmtis_transmit (TIS twin of DF-1990), leaving TPM arbitration claimed and imposing a fixed 750ms uninterruptible sleep on every later request
Summary
Only the success path relinquishes (the interrupt clear lives there) - all nine error returns leave locality claimed; the no-precheck interrupt path then never sees LOC_CHANGE for the already-owned locality, so every later transmit pays the full 750ms uninterruptible sleep (permanent ~1s/transaction after the first error; shutdown state-save stalls). Root/wheel or hostile TPM; hw-gated. Wrapper-relinquish + pre-check fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4859 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
failed transmit (stalled TPM) -> locality stays claimed + interrupts uncleared -> every later /dev/tpm0 write pays 750ms uninterruptible sleep -> shutdown state-save stalls
Evidence (decisive lines)
findings/poc/DF-4859/ (this verdict)
Verdict
Hardware-gated (no TPM ACPI device on guest): all nine error exits in tpmtis_transmit return without relinquishing locality 0 (only the success path relinquishes; the interrupt clear lives in relinquish) - the TIS twin of DF-1990. Amplifier: the interrupt path of request_locality has no pre-sleep ACCESS check, so a re-request for an already-owned locality never gets a LOC_CHANGE interrupt and EVERY subsequent transmit sleeps the full 750ms uninterruptibly - permanent ~1s-per-transaction degradation after the first error, cumulative stall for root and the shutdown path. Root/wheel 0600 cdev or hostile TPM. Wrapper-always-relinquish + pre-check fix.
No comments yet.