REDHAT-BUG-2517910: Medium severity swtpm vulnerability
A flaw was found in swtpm. The SWTPMNVRAMCheckHeader() function in src/swtpm/swtpmnvstore.c validates the caller-supplied buffer length against sizeof(bh), where bh is a blobheader pointer. Because sizeof(bh) evaluates to the pointer size (8 bytes on 64-bit, 4 on 32-bit) rather than the struct size (10 bytes for the packed blobheader), an undersized buffer passes the entry guard. The subsequent access to bh->totlen at offset 6 reads 4 bytes, overreading the allocation by 2 bytes on 64-bit systems (6 bytes on 32-bit). On 64-bit systems with glibc, the overread typically hits allocator padding and the function returns an error without crashing. On 32-bit systems or with non-glibc allocators, daemon termination is possible, causing denial of service to the associated VM. In both cases, the out-of-bounds totlen value is logged, leaking a small amount of adjacent heap data. The control channel attack path requires no encryption keys. The fix is to change sizeof(bh) to sizeof(bh).
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
An attacker needs access to the SWTPM control channel and can use the affected path without encryption keys. The supplied data must reach SWTPM_NVRAM_CheckHeader() with an undersized buffer.
Which deployments face the greatest denial-of-service risk?
32-bit systems and systems using non-glibc allocators may terminate the swtpm daemon when the out-of-bounds read occurs, causing denial of service to the associated VM. On 64-bit systems with glibc, the overread typically lands in allocator padding and the function usually returns an error rather than crashing.
Is information disclosure also possible?
Yes. The out-of-bounds totlen value is logged, which can disclose a small amount of adjacent heap data. This can occur even where the daemon does not crash.
What change fixes the vulnerable length validation?
The fix changes the validation from sizeof(bh), which measures the blobheader pointer, to sizeof(*bh), which measures the packed blobheader structure.