Bug 2519414

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in swtpm. The SWTPM_NVRAM_CheckHeader() function in src/swtpm/swtpm_nvstore.c validates the caller-supplied buffer length against sizeof(bh), where bh is a blobheader pointer. Because sizeof(bh) evaluates to the pointer size (8 bytes on 64-bit, 4 on 32-bit) rather than the struct size (10 bytes for the packed blobheader), an undersized buffer passes the entry guard. The subsequent access to bh->totlen at offset 6 reads 4 bytes, overreading the allocation by 2 bytes on 64-bit systems (6 bytes on 32-bit). On 64-bit systems with glibc, the overread typically hits allocator padding and the function returns an error without crashing. On 32-bit systems or with non-glibc allocators, daemon termination is possible, causing denial of service to the associated VM. In both cases, the out-of-bounds totlen value is logged, leaking a small amount of adjacent heap data. The control channel attack path requires no encryption keys. The fix is to change sizeof(bh) to sizeof(*bh).