In the Linux kernel, the following vulnerability has been resolved:
tpm: Lock TPM chip in tpmpmsuspend() first
Setting TPMCHIPFLAGSUSPENDED in the end of tpmpmsuspend() can be racy according, as this leaves window for tpmhwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour.
Aadress this by locking the TPM chip before checking any chip->flags both in tpmpmsuspend() and tpmhwrngread(). Move TPMCHIPFLAGSUSPENDED check inside tpmget_random() so that it will be always checked only when the lock is reserved.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "195778698118634863336277197069227974748",
"length": 264.0
},
"id": "CVE-2024-53085-08599804",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc203fe416abdd1c29da594565a7c3c4e979488e",
"target": {
"file": "drivers/char/tpm/tpm-chip.c",
"function": "tpm_hwrng_read"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50784112484429886076380271849563575383",
"108927149679097605344812686864474322372",
"212029528499087364639913821462157956031",
"151495465907971265258238138691325689164",
"47397338824007829952105854970198951787"
]
},
"id": "CVE-2024-53085-13e15839",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"target": {
"file": "drivers/char/tpm/tpm-chip.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "286664257776896447492930281447629030054",
"length": 369.0
},
"id": "CVE-2024-53085-1a9c487a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"target": {
"file": "drivers/char/tpm/tpm-interface.c",
"function": "tpm_get_random"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175124551669902568521364886597983609745",
"155310335491533268145693058484206826709",
"100409493744395874790729174744113894625",
"17493158450263274471173060339896432043",
"281985328055156410593142611336897363641",
"119604210321145246693554295155278034101",
"26982830598457437922459986877462328983",
"217432552893754842533111283133618801565",
"322476825500584225938870926145679277039",
"98154398802466186436553942847593650548",
"126372899525187035028728546353710909969",
"226615211110162709780743906238797210446",
"67260785134220043644302075492739110382",
"43924471001718128606855463021335604561",
"226179967192190893718715320171414807573",
"287180180846860422779377310438160438794",
"63929390215065607197732073376430123337",
"25801404180767609827639855234880363469",
"205886948790891555213698004336974322615",
"325364857258959200901972962988975420691",
"85118968137308410763835515383057625725",
"113012535877951072408026999227087283801",
"260088922385566103755206019433811331479",
"13908075731487247710988984829486620694",
"160620420532839296638574418387847534852"
]
},
"id": "CVE-2024-53085-1ee4c643",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc203fe416abdd1c29da594565a7c3c4e979488e",
"target": {
"file": "drivers/char/tpm/tpm-interface.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175124551669902568521364886597983609745",
"155310335491533268145693058484206826709",
"100409493744395874790729174744113894625",
"17493158450263274471173060339896432043",
"281985328055156410593142611336897363641",
"107002673649008640856846895892859149573",
"97411628652558536159908578920022082343",
"191453103213608250031930621402435388408",
"172110830351040489978988540883719293377",
"127581458651619921783227934992437455921",
"87493511003817039316477174334222598384",
"198866478789876312937085626815181120335",
"226179967192190893718715320171414807573",
"287180180846860422779377310438160438794",
"63929390215065607197732073376430123337",
"25801404180767609827639855234880363469",
"205886948790891555213698004336974322615",
"325364857258959200901972962988975420691",
"85118968137308410763835515383057625725",
"113012535877951072408026999227087283801",
"260088922385566103755206019433811331479",
"13908075731487247710988984829486620694",
"160620420532839296638574418387847534852"
]
},
"id": "CVE-2024-53085-4c850d1a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"target": {
"file": "drivers/char/tpm/tpm-interface.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "195778698118634863336277197069227974748",
"length": 264.0
},
"id": "CVE-2024-53085-562054ad",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"target": {
"file": "drivers/char/tpm/tpm-chip.c",
"function": "tpm_hwrng_read"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "101757197849885509424234600576685915021",
"length": 613.0
},
"id": "CVE-2024-53085-72064a32",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfaf83501a0cbb104499c5b0892ee5ebde4e967f",
"target": {
"file": "drivers/char/tpm/tpm-interface.c",
"function": "tpm_pm_suspend"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50784112484429886076380271849563575383",
"108927149679097605344812686864474322372",
"212029528499087364639913821462157956031",
"151495465907971265258238138691325689164",
"47397338824007829952105854970198951787"
]
},
"id": "CVE-2024-53085-8efd94ea",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc203fe416abdd1c29da594565a7c3c4e979488e",
"target": {
"file": "drivers/char/tpm/tpm-chip.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "257501108658903190989731066544436572538",
"length": 640.0
},
"id": "CVE-2024-53085-9f11b052",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc203fe416abdd1c29da594565a7c3c4e979488e",
"target": {
"file": "drivers/char/tpm/tpm-interface.c",
"function": "tpm_pm_suspend"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "286664257776896447492930281447629030054",
"length": 369.0
},
"id": "CVE-2024-53085-bc5a3152",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc203fe416abdd1c29da594565a7c3c4e979488e",
"target": {
"file": "drivers/char/tpm/tpm-interface.c",
"function": "tpm_get_random"
}
}
]