Description
In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24_status() ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2c_master_recv() when the register-select write is short or fails, leaving data uninitialized. The resulting stack value can be interpreted as TPM_STS flags and let status checks complete spuriously. The status callback cannot propagate a transport error. Return zero unless recv() reports exactly one byte. With no status bits set, callers retry or take their existing timeout or error path instead of acting on an invalid status value. This issue was found by a static analysis checker and confirmed by manual source review.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
251a7b08213af82e40e4a70cac056e245853c410 to < d732cfc4befe28f02ec82ed5fd2bc2a21fbabd42affected251a7b08213af82e40e4a70cac056e245853c410 to < 4973e8386257eed10e5433a94a53bcc6ec37d2a1affected251a7b08213af82e40e4a70cac056e245853c410 to < 981307e2e8a930da492c2bcf763865c47c2a5165affected251a7b08213af82e40e4a70cac056e245853c410 to < 1bfd5c54e40704ce93d128a25de3d8dd772bf183affected251a7b08213af82e40e4a70cac056e245853c410 to < 38c26fe4522963a91d4fb02c844d8faa740fe9d1affected251a7b08213af82e40e4a70cac056e245853c410 to < 14feaa498c20c1b7ddefe27de5329aaff822cc0daffected251a7b08213af82e40e4a70cac056e245853c410 to < e6d7d9b665419cda3e9f91030d81c9f8ba71e51daffected251a7b08213af82e40e4a70cac056e245853c410 to < 8b92687708f5ef980de01c2042dbd76d11f78547affected
Linux Linux
Default version status: affected
3.9affected0 to < 3.9unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d732cfc4befe28f02ec82ed5fd2bc2a21fbabd42 ↗
- https://git.kernel.org/stable/c/4973e8386257eed10e5433a94a53bcc6ec37d2a1 ↗
- https://git.kernel.org/stable/c/981307e2e8a930da492c2bcf763865c47c2a5165 ↗
- https://git.kernel.org/stable/c/1bfd5c54e40704ce93d128a25de3d8dd772bf183 ↗
- https://git.kernel.org/stable/c/38c26fe4522963a91d4fb02c844d8faa740fe9d1 ↗
- https://git.kernel.org/stable/c/14feaa498c20c1b7ddefe27de5329aaff822cc0d ↗
- https://git.kernel.org/stable/c/e6d7d9b665419cda3e9f91030d81c9f8ba71e51d ↗
- https://git.kernel.org/stable/c/8b92687708f5ef980de01c2042dbd76d11f78547 ↗