Closed jeremyncc closed 4 years ago
@jeremyncc thank you very much for the review!
As to your landing-zone comment, you are correct that this is used there. This is meant to be a simple, independent (aka license unencumbered) implementation that we can embedded into boot loaders and kernels.
There is still quite a bit of work to go with the implementation and you are welcome review and/or contribute.
Resolved
The
tis_recv
function contains an integer underflow problem that could lead to memory corruption.Above, the length value that was pulled out of the TPM response header,
hdr->size
, could be manipulated by a MITM on the serial bus that connects to the TPM peripheral. If this interposer device setshdr->size
such that it equalssizeof(struct tpm_header)
, thenexpected
will be equal to0
after the subtraction on line 172.On line 173,
tpmb_put
is invoked withexpected=0
for its size argument. This allows the length sanitization within the function to pass without error:Then finally
recv_data
is called withexpected-1
as its length argument, which underflows to a very large positive integer0xFFFF_FFFF
. The interposer can now send more bytes over the bus than will fit in the destination buffer. This of course results in an overflow ofbuf
.To prevent this issue,
hdr->size
needs to be bounds checked intis_recv
. It must be at least as large as the TPM response headersizeof(struct tpm_header) + 1
to preventexpected
from underflowing.Also, there is a comment in
tpmb_put
which suggests that an integer overflow check is missing. While that is true, I do not think that an underflow ofexpected
is exploitable in this function. The valueexpected
is au32
type but is cast tosize_t
when passed as an argument, andb->len
issize_t
. Therefore,b->len + size
should not be able to wrap, except on 32-bit systems whereu32
andsize_t
are the same width. But still, checking for integer wrap here is probably a good idea.Finally, I think the exact same issue is present in the landing-zone repository, here: https://github.com/TrenchBoot/landing-zone/blob/747bf7a1a6f625559146cf33b9a888403b8cb765/early_tpm.c#L387