Bug 684671 (CVE-2011-1160) - CVE-2011-1160 kernel: tpm infoleaks
Summary: CVE-2011-1160 kernel: tpm infoleaks
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2011-1160
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 684672 684673 684674 684675 684676 748694
Blocks: 732619
TreeView+ depends on / blocked
 
Reported: 2011-03-14 08:17 UTC by Eugene Teo (Security Response)
Modified: 2021-02-24 16:20 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-05-10 13:01:27 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1253 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2011-09-12 19:43:48 UTC
Red Hat Product Errata RHSA-2011:1350 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2011-10-05 21:47:16 UTC
Red Hat Product Errata RHSA-2011:1386 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2011-10-20 17:28:15 UTC

Description Eugene Teo (Security Response) 2011-03-14 08:17:20 UTC 
[PATCH 1/3] char/tpm: Fix uninitialized usage of data buffer
http://tpmdd.git.sourceforge.net/git/gitweb.cgi?p=tpmdd/tpmdd;a=commitdiff;h=459e0537ebb7b786cd29a26f4e41c721632cd840
infoleak

[PATCH 2/3] char/tpm: Call tpm_transmit with correct size
http://tpmdd.git.sourceforge.net/git/gitweb.cgi?p=tpmdd/tpmdd;a=commitdiff;h=f0bbed1ee49a4779dfb32159fea669ced8789336
infoleak

[PATCH 3/3] char/tpm: zero buffer after copying to userspace
http://tpmdd.git.sourceforge.net/git/gitweb.cgi?p=tpmdd/tpmdd;a=commitdiff;h=44480e4077cd782aa8f54eb472b292547f030520
prevents storing of previous result, leakage to other drivers

Acknowledgements:

Red Hat would like to thank Peter Huewe for reporting this issue.
Comment 3 Vincent Danen 2011-03-15 21:06:47 UTC 
As per:

http://openwall.com/lists/oss-security/2011/03/15/13

> [PATCH 1/3] char/tpm: Fix uninitialized usage of data buffer

CVE-2011-1160

> [PATCH 2/3] char/tpm: Call tpm_transmit with correct size

CVE-2011-1161

> [PATCH 3/3] char/tpm: zero buffer after copying to userspace

CVE-2011-1162
Comment 9 Eugene Teo (Security Response) 2011-08-23 06:30:34 UTC 
I'm moving CVE-2011-1161/1162 into a separate bug as there is no official fix in the upstream kernel yet. See bug 732629.
Comment 10 errata-xmlrpc 2011-09-12 19:45:01 UTC 
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html
Comment 11 Eugene Teo (Security Response) 2011-09-16 06:36:04 UTC 
Upstream commit:
https://github.com/torvalds/linux/commit/1309d7afbed112f0e8e90be9af975550caa0076b
Comment 12 errata-xmlrpc 2011-10-05 21:47:43 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:1350 https://rhn.redhat.com/errata/RHSA-2011-1350.html
Comment 14 errata-xmlrpc 2011-10-20 17:28:42 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1386 https://rhn.redhat.com/errata/RHSA-2011-1386.html
Comment 15 Eugene Teo (Security Response) 2011-10-25 04:09:44 UTC 
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 748694]
Note You need to log in before you can comment on or make changes to this bug.