Jarkko Sakkinen

تم تحديد مشكلة في نواة Linux حيث يمكن أن تتسبب مفاتيح DCP الموثوقة في حدوث تعطل أثناء تشفير وفك تشفير مفتاح تشفير blob عبر برنامج تشغيل crypto الخاص بـ DCP عندما تكون عناوين المكدس vmalloc ممكّنة. ويعود سبب ذلك إلى الاستخدام غير الصحيح لـ `sg init one()` مع مخازن مؤقتة مخصصة عبر vmalloc، وتحديدًا `plain key blob`.

The issue is related to the TPM SPI transfer mechanism in the Linux kernel, which does not account for the 4 bytes of header that prepends the SPI data frame. This can result in out-of-bounds accesses and was confirmed with KASAN. The introduction of SPI HDRSIZE is intended to account for the header and allocate the transfer buffer correctly.

The issue is related to a memory leak in the `tpm2 key encode()` function in the Trusted Platform Module (TPM) subsystem of the Linux kernel. This leak occurs because the `scratch` variable is never freed. The fix involves calling `kfree()` in both the success and error cases. Exploitation of this issue could allow an attacker to cause a denial of service.

A memory leak has been identified in the Linux kernel, specifically in the trusted key module. The issue arises from two error return paths that fail to free the allocated object `td`, resulting in a memory leak. This leak is addressed by ensuring that the error return path securely frees `td`. The fix also resolves a clang scan-build warning related to a potential memory leak in the `trusted tpm1.c` file.