Bug 1998588 (CVE-2021-3746)

Summary:	CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	davide, marcandre.lureau, stefanb, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libtpms 0.8.5, libtpms 0.7.9, libtpms 0.6.6 and later	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-08-31 13:22:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1998589, 1998590, 1999303, 1999305, 1999306, 1999307
Bug Blocks:	1997740, 1998591

Description Guilherme de Almeida Suckevicz 2021-08-27 17:01:53 UTC

A bug was discovered in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability can be triggered by specially-crafted TPM 2 command packets that then trigger the issue when the state of the TPM 2's volatile state is marshalled/written.

Reference and upstream patches:
https://github.com/stefanberger/libtpms/commit/1fb6cd9b8df05b5d6e381b31215193d6ada969df
https://github.com/stefanberger/libtpms/commit/ea62fd9679f8c6fc5e79471b33cfbd8227bfed72

Comment 1 Guilherme de Almeida Suckevicz 2021-08-27 17:02:15 UTC

Created libtpms tracking bugs for this issue:

Affects: epel-8 [bug 1998590]
Affects: fedora-all [bug 1998589]

Comment 7 devthomp 2021-08-31 13:22:12 UTC

analysis complete, patches provided and trackers filed.
resolving.