TPM2 Get Random Buffer Overflow in Linux Kernel

Executive Summary

This vulnerability is in the Linux kernel's TPM (Trusted Platform Module) driver. It involves an off-by-four error in the tpm2_get_random() function where a bounds check incorrectly validates response length. When the response has a TPM2_ST_SESSIONS tag, the function skips a 4-byte parameter size field but still checks against TPM_HEADER_SIZE. This allows a truncated response to pass validation, causing memcpy() to read up to 4 bytes past the response end, potentially exposing stale buffer contents in random data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's TPM (Trusted Platform Module) implementation. Detection requires checking the kernel version and TPM driver code. Use commands like 'uname -a' to check kernel version and 'dmesg | grep tpm' to inspect TPM-related logs for errors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to random data generated by the system containing stale memory contents instead of properly generated random bytes. This might weaken cryptographic operations that rely on randomness, such as encryption keys or secure tokens, potentially enabling security bypasses or information disclosure if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update your Linux kernel to the latest patched version. Monitor vendor advisories for kernel updates. If using a custom kernel, apply the patch for tpm2_get_random() bounds check. Disable TPM if not required.

Useful 0 Not Useful 0