tpm: fix off-by-four bounds check in tpm2_get_random() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 6 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2_get_random() When the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random() skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the response length against TPM_HEADER_SIZE. A truncated response can pass the check and make memcpy() read up to 4 bytes past the response end, so stale buffer contents end up in the caller's random bytes. Fix this by checking the response length against 'offset', which already includes the skipped parameter size field.
References
European references
- ENISA EUVD · EUVD-2026-103813
- GCVE · GCVE-0-2026-98728
CERT-FR advisories
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < be54101992c2c5218be0e0a87827ccc96e3089af ; affected 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < e30a2406408d2df6d9cd48c2e59e913cf266a05a ; affected 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < 42bb6216b861e892512128219ff23010d656ba14 ; affected 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < 9b522400bf5c082feb9a0037a053ea822a2c7e4d |
| Linux · Linux | affected 6.10 ; unaffected 0 < 6.10 ; unaffected 6.12.113 ≤ 6.12.* ; unaffected 6.18.56 ≤ 6.18.* ; unaffected 7.2.10 ≤ 7.2.* ; unaffected 7.3 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |