CVE-2024-53085

Summary

In the Linux kernel, the following vulnerability has been resolved:

tpm: Lock TPM chip in tpm_pm_suspend() first

Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour.

Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux99d46450625590d410f86fe4660a5eff7d3b8343 < cfaf83501a0cbb104499c5b0892ee5ebde4e967faffected
LinuxLinux99d46450625590d410f86fe4660a5eff7d3b8343 < bc203fe416abdd1c29da594565a7c3c4e979488eaffected
LinuxLinux99d46450625590d410f86fe4660a5eff7d3b8343 < 9265fed6db601ee2ec47577815387458ef4f047aaffected
LinuxLinux7cd46930b8bf37b84777410ac21bfdf1179021d5affected
LinuxLinuxeeda114c92c7b2db69878cdf27163750fd57cfe2affected
LinuxLinux6.1.31 < 6.2affected
LinuxLinux6.3.5 < 6.4affected
LinuxLinux6.4affected
LinuxLinux0 < 6.4unaffected
LinuxLinux6.6.64 <= 6.6.*unaffected
LinuxLinux6.11.8 <= 6.11.*unaffected
LinuxLinux6.12 <= *unaffected

Weaknesses

References