On Wed, Aug 26, 2026 at 08:18:32AM +0200, Greg KH wrote: > On Tue, Aug 25, 2026 at 06:29:18PM +0000, sn0x-sharma wrote: > > tpm_seal() computes storedsize from TPM response fields and passes > > it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds > > validation. A forged TPM response can set storedsize to 4086, > > overflowing the 512-byte blob by 3574 bytes into adjacent slab > > objects. > > > > Add a check that storedsize does not exceed MAX_BLOB_SIZE before > > the memcpy, returning -EINVAL on oversized responses. > > > > Reported-by: sn0x-sharma <[email protected]> > > Link: https://lore.kernel.org/linux-integrity/ > > That's not a valid link :(
Oops, missed this one ;-) Should be just deleted, b4 shazam will set the link tag. > > > Signed-off-by: sn0x-sharma <[email protected]> > > No need for a reported-by: if you author and sign off on the patch. > > And we need a real name please, not an alias. > > thanks, > > greg k-h BR, Jarkko
