CVE-2025-68792: tpm2-sessions: Fix out of range indexing in name_size
In the Linux kernel, the following vulnerability has been resolved:
tpm2-sessions: Fix out of range indexing in namesize
'namesize' does not have any range checks, and it just directly indexes with TPMALGID, which could lead into memory corruption at worst.
Address the issue by only processing known values and returning -EINVAL for unrecognized values.
Make also 'tpmbufappendname' and 'tpmbuffillhmacsession' fallible so that errors are detected before causing any spurious TPM traffic.
End also the authorization session on failure in both of the functions, as the session state would be then by definition corrupted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Validate name_size against known TPM_ALG_ID values and return -EINVAL for unrecognized values before indexing.
- Compensating control
Make tpm_buf_append_name and tpm_buf_fill_hmac_session fallible so errors are detected before generating TPM traffic.
- Compensating control
End the authorization session on failure in both affected functions because the session state is corrupted.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68792?
CVE-2025-68792 has a high severity due to potential memory corruption risks caused by out of range indexing.
How do I fix CVE-2025-68792?
To fix CVE-2025-68792, ensure that you update to the latest version of the Linux kernel where this vulnerability has been patched.
What kind of systems are affected by CVE-2025-68792?
CVE-2025-68792 affects systems running specific versions of the Linux kernel that utilize tpm2 sessions.
What are the potential impacts of CVE-2025-68792?
The potential impacts of CVE-2025-68792 include unauthorized access to sensitive data and system crashes due to memory corruption.
Is CVE-2025-68792 remotely exploitable?
CVE-2025-68792 is not considered remotely exploitable, typically requiring local access to the affected system.