From f6765a4cc4a3b19fd4d145c901e1c999d7757ec4 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 15 Nov 2022 01:40:23 -0500 Subject: [PATCH] import libtpms-0.9.1-2.20211126git1ff6fe1f43.el9 --- .gitignore | 1 + .libtpms.metadata | 1 + ...-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch | 37 +++ ...Fix-size-check-in-CryptSecretDecrypt.patch | 31 ++ ...g-state-initialize-s_ContextSlotMask.patch | 51 +++ SPECS/libtpms.spec | 298 ++++++++++++++++++ 6 files changed, 419 insertions(+) create mode 100644 .gitignore create mode 100644 .libtpms.metadata create mode 100644 SOURCES/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch create mode 100644 SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch create mode 100644 SOURCES/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch create mode 100644 SPECS/libtpms.spec diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..32b84c1 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/libtpms-20211126.tar.xz diff --git a/.libtpms.metadata b/.libtpms.metadata new file mode 100644 index 0000000..020dc4b --- /dev/null +++ b/.libtpms.metadata @@ -0,0 +1 @@ +ae609402e34992590961b0d025e9ef1202d8dede SOURCES/libtpms-20211126.tar.xz diff --git a/SOURCES/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch b/SOURCES/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch new file mode 100644 index 0000000..d39b0fb --- /dev/null +++ b/SOURCES/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch @@ -0,0 +1,37 @@ +From e4261984374556da65c9d46097d5a1200b335c0c Mon Sep 17 00:00:00 2001 +From: Juergen Repp +Date: Sat, 19 Feb 2022 12:59:32 +0100 +Subject: [PATCH] tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for + label of size 0 (OSSL 3) + +Openssl 3.0 did return an error if EVP_PKEY_CTX_set0_rsa_oaep_label was called +with label size 0. The function should only be called if the size of the label +is greater 0. +With this fix TPM2_RSA_Encrypt/Decrypt did work with OpenSSL 1.1 and 3.0 +for encryption without label. + +Signed-off-by: Juergen Repp +--- + src/tpm2/crypto/openssl/CryptRsa.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/tpm2/crypto/openssl/CryptRsa.c b/src/tpm2/crypto/openssl/CryptRsa.c +index 4ed04384feb0..b5d6b6c3be82 100644 +--- a/src/tpm2/crypto/openssl/CryptRsa.c ++++ b/src/tpm2/crypto/openssl/CryptRsa.c +@@ -1356,10 +1356,9 @@ CryptRsaEncrypt( + if (tmp == NULL) + ERROR_RETURN(TPM_RC_FAILURE); + memcpy(tmp, label->buffer, label->size); ++ if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0) ++ ERROR_RETURN(TPM_RC_FAILURE); + } +- // label->size == 0 is supported +- if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0) +- ERROR_RETURN(TPM_RC_FAILURE); + tmp = NULL; + break; + default: +-- +2.36.0.44.g0f828332d5ac + diff --git a/SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch b/SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch new file mode 100644 index 0000000..a886ee8 --- /dev/null +++ b/SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch @@ -0,0 +1,31 @@ +From 3d2bbe2f1947784506ba0a7f9e8ab81eefb69929 Mon Sep 17 00:00:00 2001 +From: Ross Lagerwall +Date: Mon, 23 May 2022 14:16:57 +0100 +Subject: [PATCH] tpm2: Fix size check in CryptSecretDecrypt + +Check the secret size against the size of the buffer, not the size +member that has not been set yet. + +Reported by Coverity. + +Signed-off-by: Ross Lagerwall +--- + src/tpm2/CryptUtil.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/tpm2/CryptUtil.c b/src/tpm2/CryptUtil.c +index 9879f918acb6..002fde0987a9 100644 +--- a/src/tpm2/CryptUtil.c ++++ b/src/tpm2/CryptUtil.c +@@ -732,7 +732,7 @@ CryptSecretDecrypt( + nonceCaller->t.size); + } + // make sure secret will fit +- if(secret->t.size > data->t.size) ++ if(secret->t.size > sizeof(data->t.buffer)) + return TPM_RC_FAILURE; + data->t.size = secret->t.size; + // CFB decrypt, using nonceCaller as iv +-- +2.36.0.44.g0f828332d5ac + diff --git a/SOURCES/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch b/SOURCES/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch new file mode 100644 index 0000000..59aaacc --- /dev/null +++ b/SOURCES/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch @@ -0,0 +1,51 @@ +From b662e6fd7169f31ef664ecd0b0b45547462e1e31 Mon Sep 17 00:00:00 2001 +From: Stefan Berger +Date: Tue, 4 Jan 2022 14:45:31 -0500 +Subject: [PATCH] tpm2: When writing state initialize s_ContextSlotMask if not + set + +If s_ContextSlotMask was not set since the TPM 2 was not initialized +by a call to TPM_Manufacture() or the state was not resumed, then +initialize the s_ContextSlotMask to 0xffff. + +This situation can occur if a VM with an attached swtpm was started +and the VM's firmware either doesn't support TPM or didn't get to +initialize the vTPM. + +The following commands recreated the issue with a SeaBIOS-only VM that +had no attached hard disk but an attached TPM 2: + +virsh start BIOS-only-VM ; virsh save BIOS-only-VM save.bin ; \ + virsh restore save.bin + +Error: Failed to restore domain from save.bin +error: internal error: qemu unexpectedly closed the monitor: \ +2022-01-04T19:26:18.835851Z qemu-system-x86_64: tpm-emulator: Setting the stateblob (type 2) failed with a TPM error 0x3 a parameter is bad +2022-01-04T19:26:18.835899Z qemu-system-x86_64: error while loading state for instance 0x0 of device 'tpm-emulator' +2022-01-04T19:26:18.835929Z qemu-system-x86_64: load of migration failed: Input/output error + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2035731 +Signed-off-by: Stefan Berger +--- + src/tpm2/NVMarshal.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c +index 996c73c..c7cd1e0 100644 +--- a/src/tpm2/NVMarshal.c ++++ b/src/tpm2/NVMarshal.c +@@ -1422,6 +1422,11 @@ STATE_RESET_DATA_Marshal(STATE_RESET_DATA *data, BYTE **buffer, INT32 *size) + written += UINT16_Marshal(&array_size, buffer, size); + for (i = 0; i < array_size; i++) + written += UINT16_Marshal(&data->contextArray[i], buffer, size); ++ ++ if (s_ContextSlotMask != 0x00ff && s_ContextSlotMask != 0xffff) { ++ /* TPM wasn't initialized, so s_ContextSlotMask wasn't set */ ++ s_ContextSlotMask = 0xffff; ++ } + written += UINT16_Marshal(&s_ContextSlotMask, buffer, size); + + written += UINT64_Marshal(&data->contextCounter, buffer, size); +-- +2.36.1 + diff --git a/SPECS/libtpms.spec b/SPECS/libtpms.spec new file mode 100644 index 0000000..bf4da0e --- /dev/null +++ b/SPECS/libtpms.spec @@ -0,0 +1,298 @@ +%global gitdate 20211126 +%global gitversion 1ff6fe1f43 + +Name: libtpms +Version: 0.9.1 +Release: 2.%{gitdate}git%{gitversion}%{?dist} + +Summary: Library providing Trusted Platform Module (TPM) functionality +License: BSD +Url: http://github.com/stefanberger/libtpms +Source0: libtpms-%{gitdate}.tar.xz +Patch0001: 0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch +Patch0002: 0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch +Patch0003: 0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch + +BuildRequires: openssl-devel +BuildRequires: pkgconfig gawk sed +BuildRequires: automake autoconf libtool bash coreutils gcc-c++ +BuildRequires: make + +%description +A library providing TPM functionality for VMs. Targeted for integration +into Qemu. + +%package devel +Summary: Include files for libtpms +Requires: %{name}%{?_isa} = %{version}-%{release} + +%description devel +Libtpms header files and documentation. + +%prep +%autosetup -p1 -n %{name}-%{gitdate} +%build +NOCONFIGURE=1 sh autogen.sh +%configure --disable-static --with-tpm2 --without-tpm1 --with-openssl +%make_build + +%check +make check + +%install +%make_install +find %{buildroot} -type f -name '*.la' | xargs rm -f -- || : + +%ldconfig_scriptlets + +%files +%license LICENSE +%doc README CHANGES +%{_libdir}/lib*.so.* + +%files devel +%dir %{_includedir}/%{name} +%{_includedir}/%{name}/*.h +%{_libdir}/lib*.so +%{_libdir}/pkgconfig/*.pc +%{_mandir}/man3/* + +%changelog +* Mon Jun 20 2022 Marc-André Lureau - 0.9.1-2.20211126git1ff6fe1f43 +- Backport s_ContextSlotMask initialization fix + Resolves: rhbz#2035731 + +* Mon Jun 13 2022 Marc-André Lureau - 0.9.1-1.20211126git1ff6fe1f43 +- Backport RSA/OAEP fixes. + Resolves: rhbz#2093651 + +* Wed Dec 01 2021 Marc-André Lureau - 0.9.1-0.20211126git1ff6fe1f43 +- Rebase to 0.9.1 + Resolves: rhbz#2027951 + +* Tue Nov 9 2021 Marc-André Lureau - 0.9.0-0.20211004gitdc4e3f6313 +- Rebase to 0.9.0, disable TPM 1.2 + Resolves: rhbz#1990152 & rhbz#2021628 + +* Tue Aug 31 2021 Marc-André Lureau - 0.8.2-0.20210301git729fc6a4ca.7 +- Fixes CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets + Resolves: rhbz#1999303 + +* Mon Aug 09 2021 Mohan Boddu - 0.8.2-0.20210301git729fc6a4ca.6 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Wed Jun 30 2021 Marc-André Lureau - 0.8.2-0.20210301git729fc6a4ca.5 +- Fixes CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM + Resolves: rhbz#1976814 + +* Wed Jun 16 2021 Mohan Boddu - 0.8.2-0.20210301git729fc6a4ca.4 +- Rebuilt for RHEL 9 BETA for openssl 3.0 + Related: rhbz#1971065 + +* Tue May 18 2021 Marc-André Lureau - 0.8.2-0.20210301git729fc6a4ca.3 +- Add -Wno-error=deprecated-declarations, to ignore OpenSSL 3.0 deprecation warnings. + Fixes: rhbz#1958054 + +* Fri Apr 16 2021 Mohan Boddu - 0.8.2-0.20210301git729fc6a4ca.2 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Mon Mar 01 2021 Stefan Berger - 0.8.2-0.20210301git729fc6a4ca +- tpm2: CryptSym: fix AES output IV; a CVE has been filed for this issue + +* Sat Feb 27 2021 Stefan Berger - 0.8.1-0.20210227git5bf2746e47 +- Fixed a context save and suspend/resume problem when public keys are loaded + +* Thu Feb 18 2021 Stefan Berger - 0.7.5-0.20210218gite271498466 +- Addressed UBSAN and cppcheck detected issues +- Return proper size of ECC Parameters to pass HLK tests + +* Tue Jan 26 2021 Fedora Release Engineering - 0.7.4-0.20201031git2452a24dab.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Sat Oct 31 2020 Stefan Berger - 0.7.4-0.20201031git2452a24dab +- Follow stable-0.7.0 branch to v0.7.4 with security-related fixes + +* Fri Jul 31 2020 Stefan Berger - 0.7.3-0.20200731git1d392d466a +- Follow stable-0.7.0 branch to v0.7.3 + +* Tue Jul 28 2020 Fedora Release Engineering - 0.7.2-0.20200527git7325acb477.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed May 27 2020 Stefan Berger - 0.7.2-0.20200527git7325acb477 +- Following stable-0.7.0 branch for TPM 2 related fixes: RSA decryption, + PSS salt length, symmetric decryption (padding) +- Under certain circumstances an RSA decryption could cause a buffer overflow causing + termination of the program (swtpm) + +* Wed May 20 2020 Stefan Berger - 0.7.1-0.20200520git8fe99d1fd0 +- Following stable-0.7.0 branch for TPM 2 related fixes; v0.7.1 + gcc related patch +- elliptic curve fixes +- MANUFACTURER changed from "IBM " to "IBM" +- gcc 10 related fix + +* Wed Jan 29 2020 Fedora Release Engineering - 0.7.0-0.20191018gitdc116933b7.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Oct 18 2019 Stefan Berger - 0.7.0-0.20191018gitdc116933b7 +- Following stable-0.7.0 branch for TPM 1.2 related bugfix + +* Tue Oct 08 2019 Stefan Berger - 0.7.0-0.20191008gitc26e8f7b08 +- Following stable-0.7.0 branch for bug fix + +* Thu Jul 25 2019 Fedora Release Engineering - 0.7.0-0.20190719gitd061d8065b.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri Jul 19 2019 Stefan Berger - 0.7.0-0.20190719gitd061d8065b +- Update to v0.7.0 + +* Fri May 10 2019 Stefan Berger - 0.6.1-0.20190510gitb244bdf6e2 +- Applied bugfix for CMAC + +* Fri Feb 01 2019 Fedora Release Engineering - 0.6.1-0.20190121git9dc915572b.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 21 2019 Stefan Berger - 0.6.1-0.20190121git9dc915572b +- Libtpms was updated to rev. 150 of TPM 2.0 code +- following branch stable-0.6.0 + +* Tue Dec 11 2018 Stefan Berger - 0.6.0-0.20181211gitba56737b93 +- Following bugfixes in libtpms + +* Wed Oct 31 2018 Stefan Berger - 0.6.0-0.20181031git0466fcf6a4 +- Following improvements in libtpms + +* Tue Sep 18 2018 Stefan Berger - 0.6.0-0.20180914git4111bd1bcf +- Build snapshot from git, simplify spec + +* Fri Jul 13 2018 Fedora Release Engineering - 0.5.2-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Wed Feb 07 2018 Fedora Release Engineering - 0.5.2-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Aug 03 2017 Fedora Release Engineering - 0.5.2-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 0.5.2-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Fri Feb 10 2017 Fedora Release Engineering - 0.5.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Thu Feb 04 2016 Fedora Release Engineering - 0.5.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Wed Jun 17 2015 Fedora Release Engineering - 0.5.2-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Sun Aug 17 2014 Fedora Release Engineering - 0.5.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sat Aug 16 2014 Stefan Berger - 0.5.2-3 +- do not include libtpms.la in rpm + +* Mon Jul 14 2014 Stefan Berger - 0.5.2-2 +- Added patches + +* Mon Jun 30 2014 Stefan Berger - 0.5.2-1 +- Updated to version 0.5.2 +- coverity fixes +- fixes for ARM64 using __aarch64__ + +* Sat Jun 07 2014 Fedora Release Engineering - 0.5.1-20.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sat Aug 03 2013 Fedora Release Engineering - 0.5.1-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Mon Mar 25 2013 Stefan Berger - 0.5.1-18 +- Ran autoreconf for support of aarch64 +- Checking for __arm64__ in code + +* Thu Feb 14 2013 Fedora Release Engineering - 0.5.1-17 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Thu Jul 19 2012 Fedora Release Engineering - 0.5.1-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Fri Feb 17 2012 Peter Robinson - 0.5.1-15 +- Add dist tag as required by package guidelines + +* Fri Jan 27 2012 Stefan Berger - 0.5.1-14 +- fix gcc-4.7 compilation problem + +* Fri Jan 13 2012 Fedora Release Engineering - 0.5.1-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Tue Dec 20 2011 Dan Horák - 0.5.1-12 +- fix build on secondary arches + +* Wed Nov 2 2011 Stefan Berger - 0.5.1-11 +- added (lib)gmp as runtime dependency + +* Sat Oct 8 2011 Stefan Berger - 0.5.1-10 +- internal fixes; callback fixes + +* Tue Aug 30 2011 Stefan Berger - 0.5.1-9 +- new directory structure and build process + +* Tue Jul 12 2011 Stefan Berger - 0.5.1-8 +- added pkgconfig as build dependency +- enabling __powerpc__ build following Bz 728220 + +* Wed May 25 2011 Stefan Berger - 0.5.1-7 +- increasing NVRAM area space to have enough room for certificates + +* Wed May 25 2011 Stefan Berger - 0.5.1-6 +- adding libtpms.pc pkg-config file + +* Wed Apr 13 2011 Stefan Berger - 0.5.1-5 +- adding BuildRequires for nss-softokn-freebl-static +- several libtpms-internal changes around state serialization and + deserialization +- fixes to libtpms makefile (makefile-libtpms) +- adding build_type to generate a debug or production build +- need nss-devel to have nss-config + +* Tue Mar 08 2011 Stefan Berger - 0.5.1-4 +- small fixes to libtpms makefile + +* Fri Feb 25 2011 Stefan Berger - 0.5.1-3 +- removing release from tar ball name +- Use {?_smp_mflags} for make rather than hardcoding it +- Fixing post and postun scripts; removing the scripts for devel package +- Fixing usage of defattr +- Adding version information into the changelog headers and spaces between the changelog entries +- Adding LICENSE, README and CHANGELOG file into tar ball and main rpm +- Removing clean section +- removed command to clean the build root +- adding library version to the libries required for building and during + runtime +- Extended Requires in devel package with {?_isa} + +* Fri Feb 18 2011 Stefan Berger - 0.5.1-2 +- make rpmlint happy by replacing tabs with spaces +- providing a valid URL for the tgz file +- release is now 2 -> 0.5.1-2 + +* Mon Jan 17 2011 Stefan Berger - 0.5.1-1 +- Update version to 0.5.1 + +* Fri Jan 14 2011 Stefan Berger - 0.5.0-1 +- Changes following Fedora review comments + +* Thu Dec 2 2010 Stefan Berger +- Small tweaks after reading the FedoreCore packaging requirements + +* Tue Nov 16 2010 Stefan Berger +- Created initial version of rpm spec files +- Version of library is now 0.5.0 +- Debuginfo rpm is built but empty -- seems to be a known problem + Check https://bugzilla.redhat.com/show_bug.cgi?id=209316