Bug 1964358 (CVE-2021-3569)

Summary:	CVE-2021-3569 libtpms: stack corruption bug in RSA decryption
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	davide, marcandre.lureau, stefanb, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libtpms 0.7.2, libtpms 0.8.0	Doc Type:	If docs needed, set a value
Doc Text:	A stack corruption bug was found in libtpms while decrypting data using RSA. This flaw could result in a SIGBUS (bad memory access) and termination of swtpm. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-29 09:06:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1942902
Bug Blocks:	1964347, 1965639

Description Mauro Matteo Cascella 2021-05-25 10:14:13 UTC

A stack corruption bug was found in libtpms while decrypting data using RSA. The bug exists in CryptRsaDecrypt() in src/tpm2/crypto/openssl/CryptRsa.c. This flaw could cause a SIGBUS (bad memory access) and termination of swtpm.

Upstream commits:
https://github.com/stefanberger/libtpms/commit/505ef841c00b4c096b1977c667cb957bec3a1d8b [v0.8.0]
https://github.com/stefanberger/libtpms/commit/40cfe134c017d3aeaaed05ce71eaf9bfbe556b16 [v0.7.2]

Comment 7 Stefan Berger 2021-10-14 21:15:21 UTC

This bug has been fixed a while ago. I think this bugzilla can be closed.