> On 26 Aug 2026, at 1:34 PM, Sanket Sharma <[email protected]> wrote:
>
> TSS_checkhmac1() and TSS_checkhmac2() silently return success when the
> response tag is TPM_TAG_RSP_COMMAND (0x00c4), bypassing HMAC
> verification entirely. A forged TPM response with this unauthenticated
> tag allows an attacker to skip integrity checks on TPM responses.
>
> Reject TPM_TAG_RSP_COMMAND with -EINVAL in both functions, requiring
> all responses to carry a proper authenticated tag.
>
> Signed-off-by: Sanket Sharma <[email protected]>
> ---
> security/keys/trusted-keys/trusted_tpm1.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/security/keys/trusted-keys/trusted_tpm1.c
> b/security/keys/trusted-keys/trusted_tpm1.c
> index d47cb7108..c89fc6cfe 100644
> --- a/security/keys/trusted-keys/trusted_tpm1.c
> +++ b/security/keys/trusted-keys/trusted_tpm1.c
> @@ -202,7 +202,7 @@ static int TSS_checkhmac1(unsigned char *buffer,
> ordinal = command;
> result = LOAD32N(buffer, TPM_RETURN_OFFSET);
> if (tag == TPM_TAG_RSP_COMMAND)
> - return 0;
> + return -EINVAL;
Hi Sanket Sharma,
Instead of changing the return value to -EINVAL inside the TPM_TAG_RSP_COMMAND
check,
we can simplify the control flow by removing that block entirely.Since
TPM_TAG_RSP_COMMAND is
inherently not equal to TPM_TAG_RSP_AUTH1_COMMAND, the subsequent mismatch
check will naturally
catch it and return -EINVAL.
Thanks,
Sudhakar
> if (tag != TPM_TAG_RSP_AUTH1_COMMAND)
> return -EINVAL;
> authdata = buffer + bufsize - SHA1_DIGEST_SIZE;
> @@ -270,7 +270,7 @@ static int TSS_checkhmac2(unsigned char *buffer,
> result = LOAD32N(buffer, TPM_RETURN_OFFSET);
>
> if (tag == TPM_TAG_RSP_COMMAND)
> - return 0;
> + return -EINVAL;
> if (tag != TPM_TAG_RSP_AUTH2_COMMAND)
> return -EINVAL;
> authdata1 = buffer + bufsize - (SHA1_DIGEST_SIZE + 1
> --
> 2.53.0
>
>
