Re: [PATCH] KEYS: trusted: Reject short TPM2 public areas

tpm2_load_cmd() reads TPMA_OBJECT with get_unaligned_be32(pub + 4), but
does not require public_len to cover that field.

A new-format blob with public_len zero makes the read begin at the end of
the B + 4-byte decoded allocation, causing a four-byte heap out-of-bounds
read before the TPM command is transmitted. This is reachable from an
unprivileged add_key() call when TPM trusted keys and a TPM2 device are
available.

This affects v5.13-rc1 and later kernels built with CONFIG_TRUSTED_KEYS=y
and CONFIG_TRUSTED_KEYS_TPM=y when a TPM2 device is present. A KASAN run
as UID 1000 with no effective capabilities reported:

BUG: KASAN: slab-out-of-bounds in tpm2_unseal_trusted
Read of size 4 at addr ffff888106273b48 by task exploit/160
[ ... ]

Fixes: e5fb5d2c5a03 ("security: keys: trusted: Make sealed key properly interoperable")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <redacted>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925095308.3248297-1-4ncienth@gmail.com?part=1