On 9/24/26 3:41 AM, [email protected] wrote:
Only read a byte from the response buffer, if the rw_offset < len.
OOB read from malicious driver is CVE-level.
It would not read outside the allocated bounds of the s->buffer but
outside of the bounds of the returned TPM response. But this is only
possible if 0 bytes were returned, so it would only ever read s->buffer[0].
The foollowing line then resets the TPM_TIS_STS_DATA_AVAILABLE flag so
that it would not read another byte. IMO, this is not a CVE.
tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID);
Signed-off-by: Stefan Berger <[email protected]>
Message-ID: <[email protected]>
diff --git a/hw/tpm/tpm_tis_common.c b/hw/tpm/tpm_tis_common.c
index a134d5c20599..4ba228116b64 100644
--- a/hw/tpm/tpm_tis_common.c
+++ b/hw/tpm/tpm_tis_common.c
@@ -273,13 +273,15 @@ static uint32_t tpm_tis_data_read(TPMState *s, uint8_t
locty)
len = MIN(tpm_cmd_get_size(&s->buffer),
s->be_buffer_size);
- ret = s->buffer[s->rw_offset++];
+ if (s->rw_offset < len) {
+ ret = s->buffer[s->rw_offset++];
+ trace_tpm_tis_data_read(ret, s->rw_offset - 1);
+ }
if (s->rw_offset >= len) {
/* got last byte */
tpm_tis_sts_set(&s->loc[locty], TPM_TIS_STS_VALID);
tpm_tis_raise_irq(s, locty, TPM_TIS_INT_STS_VALID);
}
- trace_tpm_tis_data_read(ret, s->rw_offset - 1);
}
return ret;
Reviewed-by: Marc-André Lureau <[email protected]>
