In the Linux kernel, the following vulnerability has been resolved:
tpm: Lock TPM chip in tpmpmsuspend() first
Setting TPMCHIPFLAGSUSPENDED in the end of tpmpmsuspend() can be racy according, as this leaves window for tpmhwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour.
Aadress this by locking the TPM chip before checking any chip->flags both in tpmpmsuspend() and tpmhwrngread(). Move TPMCHIPFLAGSUSPENDED check inside tpmget_random() so that it will be always checked only when the lock is reserved.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53085.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53085.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/char/tpm/tpm-chip.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"deprecated": false,
"digest": {
"line_hashes": [
"50784112484429886076380271849563575383",
"108927149679097605344812686864474322372",
"212029528499087364639913821462157956031",
"151495465907971265258238138691325689164",
"47397338824007829952105854970198951787"
],
"threshold": 0.9
},
"id": "CVE-2024-53085-13e15839",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/char/tpm/tpm-interface.c",
"function": "tpm_get_random"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"deprecated": false,
"digest": {
"function_hash": "286664257776896447492930281447629030054",
"length": 369.0
},
"id": "CVE-2024-53085-1a9c487a",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/char/tpm/tpm-interface.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"deprecated": false,
"digest": {
"line_hashes": [
"175124551669902568521364886597983609745",
"155310335491533268145693058484206826709",
"100409493744395874790729174744113894625",
"17493158450263274471173060339896432043",
"281985328055156410593142611336897363641",
"107002673649008640856846895892859149573",
"97411628652558536159908578920022082343",
"191453103213608250031930621402435388408",
"172110830351040489978988540883719293377",
"127581458651619921783227934992437455921",
"87493511003817039316477174334222598384",
"198866478789876312937085626815181120335",
"226179967192190893718715320171414807573",
"287180180846860422779377310438160438794",
"63929390215065607197732073376430123337",
"25801404180767609827639855234880363469",
"205886948790891555213698004336974322615",
"325364857258959200901972962988975420691",
"85118968137308410763835515383057625725",
"113012535877951072408026999227087283801",
"260088922385566103755206019433811331479",
"13908075731487247710988984829486620694",
"160620420532839296638574418387847534852"
],
"threshold": 0.9
},
"id": "CVE-2024-53085-4c850d1a",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/char/tpm/tpm-chip.c",
"function": "tpm_hwrng_read"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"deprecated": false,
"digest": {
"function_hash": "195778698118634863336277197069227974748",
"length": 264.0
},
"id": "CVE-2024-53085-562054ad",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/char/tpm/tpm-interface.c",
"function": "tpm_pm_suspend"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"deprecated": false,
"digest": {
"function_hash": "101757197849885509424234600576685915021",
"length": 613.0
},
"id": "CVE-2024-53085-72064a32",
"signature_type": "Function"
}
]