Merge pull request #561 from aidangarske/fenrir-fixes-7263-7285

Fix fwTPM response buffer overflow, SPDM clear-frame command bypass, and other misc hardening

Author: dgarske

examples/bench/bench.c

@@ -191,7 +191,8 @@ static int bench_sym_aes(WOLFTPM2_DEV* dev, WOLFTPM2_KEY* storageKey,
     if (rc != 0) goto exit;
     rc = wolfTPM2_CreateAndLoadKey(dev, &aesKey, &storageKey->handle,
         &publicTemplate, (byte*)gUsageAuth, sizeof(gUsageAuth)-1);
-    if ((rc & TPM_RC_MODE) == TPM_RC_MODE || (rc & TPM_RC_VALUE) == TPM_RC_VALUE) {
+    if ((rc & RC_MAX_FMT1) == TPM_RC_MODE ||
+            (rc & RC_MAX_FMT1) == TPM_RC_VALUE) {
         printf("Benchmark symmetric %s not supported!\n", desc);
         rc = 0; goto exit;
     }
@@ -234,6 +235,7 @@ static int bench_pqc_mldsa(WOLFTPM2_DEV* dev, double maxDuration,
     XMEMSET(&mldsaKey, 0, sizeof(mldsaKey));
     XMEMSET(&publicTemplate, 0, sizeof(publicTemplate));
     XMEMSET(message, 0x11, sizeof(message));
+    XMEMSET(sig, 0, sizeof(sig));
 
     rc = wolfTPM2_GetKeyTemplate_MLDSA(&publicTemplate,
         TPMA_OBJECT_sign | TPMA_OBJECT_fixedTPM | TPMA_OBJECT_fixedParent |
@@ -275,6 +277,8 @@ static int bench_pqc_mldsa(WOLFTPM2_DEV* dev, double maxDuration,
     } while (bench_stats_check(start, &count, maxDuration));
     rc = bench_asym_done("ML-DSA", 65, "sign", count, start, rc);
     if (rc != 0) goto exit;
+    if (count == 0)
+        goto exit; /* no signature produced; nothing to verify */
 
     bench_stats_start(&count, &start);
     do {

examples/nvram/read.c

@@ -187,7 +187,7 @@ int TPM2_NVRAM_Read_Example(void* userCtx, int argc, char *argv[])
 
     printf("NV Read: Attributes 0x%08x\n", nv.attributes);
 
-    if (((nv.attributes & TPMA_NV_TPM_NT) >> 4) & TPM_NT_EXTEND) {
+    if (((nv.attributes & TPMA_NV_TPM_NT) >> 4) == TPM_NT_EXTEND) {
         byte digest[TPM_SHA256_DIGEST_SIZE];
         word32 digestLen = (word32)sizeof(digest);
         printf("NV Read Extend\n");

examples/pcr/policy.c

@@ -145,15 +145,15 @@ int TPM2_PCR_Policy_Test(void* userCtx, int argc, char *argv[])
     }
     printf("wolfTPM2_Init: success\n");
 
-    if (paramEncAlg != TPM_ALG_NULL) {
-        /* Start an authenticated policy session (salted / unbound) */
-        rc = wolfTPM2_StartSession(&dev, &tpmSession, NULL, NULL,
-            TPM_SE_POLICY, paramEncAlg);
-        if (rc != 0) goto exit;
-        printf("TPM2_StartAuthSession: sessionHandle 0x%x\n",
-            (word32)tpmSession.handle.hndl);
+    /* Start an authenticated policy session (salted / unbound) */
+    rc = wolfTPM2_StartSession(&dev, &tpmSession, NULL, NULL,
+        TPM_SE_POLICY, paramEncAlg);
+    if (rc != 0) goto exit;
+    printf("TPM2_StartAuthSession: sessionHandle 0x%x\n",
+        (word32)tpmSession.handle.hndl);
 
-        /* set session for authorization of the storage key */
+    if (paramEncAlg != TPM_ALG_NULL) {
+        /* set session for parameter encryption */
         rc = wolfTPM2_SetAuthSession(&dev, 0, &tpmSession,
             (TPMA_SESSION_decrypt | TPMA_SESSION_encrypt | TPMA_SESSION_continueSession));
         if (rc != 0) goto exit;

examples/pcr/quote.c

@@ -210,6 +210,7 @@ int TPM2_PCR_Quote_Test(void* userCtx, int argc, char *argv[])
         pubKey = (byte*)XMALLOC(pubKeySz, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
         if (pubKey == NULL) {
             printf("Failed to malloc buffer for public key\n");
+            rc = MEMORY_E;
             goto exit;
         }
 

examples/run_examples.sh

@@ -835,6 +835,23 @@ if [ $WOLFCRYPT_ENABLE -eq 1 ]; then
 fi
 rm -f zip.quote
 
+# PCR Policy tests
+echo -e "PCR Policy tests"
+./examples/pcr/policy 16 >> $TPMPWD/run.out 2>&1
+RESULT=$?
+[ $RESULT -ne 0 ] && echo -e "pcr policy failed! $RESULT" && exit 1
+if [ $WOLFCRYPT_ENABLE -eq 1 ]; then
+    ./examples/pcr/policy 16 -xor >> $TPMPWD/run.out 2>&1
+    RESULT=$?
+    [ $RESULT -ne 0 ] && echo -e "pcr policy param enc xor failed! $RESULT" && exit 1
+
+    if [ $WOLFCRYPT_DEFAULT -eq 0 ]; then
+        ./examples/pcr/policy 16 -aes >> $TPMPWD/run.out 2>&1
+        RESULT=$?
+        [ $RESULT -ne 0 ] && echo -e "pcr policy param enc aes failed! $RESULT" && exit 1
+    fi
+fi
+
 
 # Benchmark tests
 echo -e "Benchmark tests"

hal/tpm_io.c

@@ -208,6 +208,12 @@ int TPM2_IoCb(TPM2_CTX* ctx, INT32 isRead, UINT32 addr,
     }
 #endif
 
+#if !defined(WOLFTPM_I2C) && !defined(WOLFTPM_MMIO) && !defined(WOLFTPM_FWTPM_HAL)
+    /* the FIFO register transfers plaintext command/response payload */
+    TPM2_ForceZero(txBuf, sizeof(txBuf));
+    TPM2_ForceZero(rxBuf, sizeof(rxBuf));
+#endif
+
     (void)ctx;
 
     return ret;