From: "Theodore Y. Ts'o" <tytso@mit.edu>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Meelis Roos <mroos@linux.ee>,
Linux Kernel list <linux-kernel@vger.kernel.org>,
"open list:HARDWARE RANDOM NUMBER GENERATOR CORE"
<linux-crypto@vger.kernel.org>
Subject: Re: rng_dev_read: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64'
Date: Mon, 10 Sep 2018 16:42:19 -0400 [thread overview]
Message-ID: <20180910204219.GG16557@thunk.org> (raw)
In-Reply-To: <CAKv+Gu-GUdYgy=cJnD5-HB3c2vxv53YbzY10CATocqP2DQrAwg@mail.gmail.com>
On Mon, Sep 10, 2018 at 10:02:38PM +0200, Ard Biesheuvel wrote:
> >> [146535.257274] tpm tpm0: A TPM error (379) occurred attempting get random
> >> [146535.257304] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' (offset 0, size 379)!
>
> The TPM return code '379' is returned from rng_get_data(), and
> interpreted as a byte count rather than an error code.
So there are two bugs here. Once is in the TPM hw_random driver; it
shouldn't be returning the TPM error code. The second is that
rng_dev_read() should be more suspicious and validate the number of
bytes returned from the low-level hw_random driver for sanity.
- Ted
prev parent reply other threads:[~2018-09-10 20:42 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-10 17:08 rng_dev_read: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' Meelis Roos
2018-09-10 19:53 ` Theodore Y. Ts'o
2018-09-10 19:53 ` Theodore Y. Ts'o
2018-09-10 20:02 ` Meelis Roos
2018-09-10 20:02 ` Meelis Roos
2018-09-10 20:02 ` Ard Biesheuvel
2018-09-10 20:42 ` Theodore Y. Ts'o [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180910204219.GG16557@thunk.org \
--to=tytso@mit.edu \
--cc=ard.biesheuvel@linaro.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mroos@linux.ee \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.