In the Linux kernel, the following vulnerability has been resolved:
tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
maximum transfer length and the size of the transfer buffer. As such, it
does not account for the 4 bytes of header that prepends the SPI data
frame. This can result in out-of-bounds accesses and was confirmed with
KASAN.
Introduce SPI_HDRSIZE to account for the header and use to allocate the
transfer buffer.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: Linux
Published: 2024-06-21T11:18:46.822Z
Updated: 2024-08-02T03:37:05.216Z
Reserved: 2024-06-21T11:16:40.603Z
Link: CVE-2024-36477
Vulnrichment
Updated: 2024-06-21T13:25:44.841Z
NVD
Status : Analyzed
Published: 2024-06-21T12:15:11.040
Modified: 2024-06-24T18:38:40.737
Link: CVE-2024-36477
Redhat