From 897f5e4afcfe62db3ee49ac5c195bbb2d133199c Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 12 Aug 2026 14:40:29 -0700 Subject: [PATCH 1/3] F-9200 - Validate PolicyAuthorize keySign name hash and length --- src/fwtpm/fwtpm_command.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/fwtpm/fwtpm_command.c b/src/fwtpm/fwtpm_command.c index 9a9a25d8..764441ab 100644 --- a/src/fwtpm/fwtpm_command.c +++ b/src/fwtpm/fwtpm_command.c @@ -9726,6 +9726,7 @@ static TPM_RC FwCmd_PolicyAuthorize(FWTPM_CTX* ctx, TPM2_Packet* cmd, byte ccBuf[4]; UINT32 cc = TPM_CC_PolicyAuthorize; TPMI_ALG_HASH keyNameAlg = TPM_ALG_SHA256; /* from keySignName */ + int keyNameDigestSz = 0; (void)cmdSize; FWTPM_ALLOC_VAR(hashCtx, wc_HashAlg); @@ -9760,11 +9761,25 @@ static TPM_RC FwCmd_PolicyAuthorize(FWTPM_CTX* ctx, TPM2_Packet* cmd, TPM2_Packet_ParseBytes(cmd, keySignName, keySignNameSz); /* Extract nameAlg from keySignName (first 2 bytes, big-endian). - * This determines the hash algorithm for aHash and ticket HMAC. */ + * This determines the hash algorithm for aHash and ticket HMAC. A + * valid Name is a supported hash selector followed by exactly that + * algorithm's digest. */ if (keySignNameSz >= 2) { keyNameAlg = (TPMI_ALG_HASH)( ((UINT16)keySignName[0] << 8) | keySignName[1]); + keyNameDigestSz = TPM2_GetHashDigestSize(keyNameAlg); + if (keyNameDigestSz <= 0) { + rc = TPM_RC_HASH; + } + else if (keySignNameSz != (UINT16)(2 + keyNameDigestSz)) { + rc = TPM_RC_SIZE; + } } + else { + rc = TPM_RC_SIZE; + } + } + if (rc == 0) { /* checkTicket: TPMT_TK_VERIFIED: tag(2) + hierarchy(4) + digest(TPM2B) * Per TPM 2.0 Part 3 Section 23.16: verify ticket was produced by From 4d543addc148de96049f4ce9225cead303f94cb1 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 12 Aug 2026 14:40:29 -0700 Subject: [PATCH 2/3] F-9201 - Return TPM_RC_VALUE for an invalid PolicyAuthorize ticket --- src/fwtpm/fwtpm_command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/fwtpm/fwtpm_command.c b/src/fwtpm/fwtpm_command.c index 764441ab..e308896b 100644 --- a/src/fwtpm/fwtpm_command.c +++ b/src/fwtpm/fwtpm_command.c @@ -9890,7 +9890,7 @@ static TPM_RC FwCmd_PolicyAuthorize(FWTPM_CTX* ctx, TPM2_Packet* cmd, "(tag=0x%x, hier=0x%x, ticketSz=%d, expectedSz=%d)\n", ticketTag, ticketHier, ticketDigestSz, expectedSz); #endif - rc = TPM_RC_POLICY_FAIL; + rc = TPM_RC_VALUE; } } TPM2_ForceZero(aHash, sizeof(aHash)); From f55b0a6395d5e9ef6788659842159c3d10cc9fec Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Wed, 12 Aug 2026 14:40:29 -0700 Subject: [PATCH 3/3] F-9202 - Return TPM_RC_VALUE for a PolicyAuthorize approvedPolicy mismatch --- src/fwtpm/fwtpm_command.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/fwtpm/fwtpm_command.c b/src/fwtpm/fwtpm_command.c index e308896b..5420f572 100644 --- a/src/fwtpm/fwtpm_command.c +++ b/src/fwtpm/fwtpm_command.c @@ -9933,7 +9933,7 @@ static TPM_RC FwCmd_PolicyAuthorize(FWTPM_CTX* ctx, TPM2_Packet* cmd, printf("fwTPM: PolicyAuthorize: " "approvedPolicy != policyDigest\n"); #endif - rc = TPM_RC_POLICY_FAIL; + rc = TPM_RC_VALUE; } } }