An issue in tpm2-abrmd has been announced here: https://www.openwall.com/lists/oss-security/2022/04/20/3 This is only the beginning of the discussion and a clear solution is to come. Mageia 8 is also affected.
Whiteboard: (none) => MGA8TOO
The announcement is long & dense, including: - The Intel TPM 2.0 software stack offers software components for accessing TPM 2.0 hardware features. The stack's main components are the core libraries tpm2-tss [1], a set of command line tools tpm2-tools [2] and the userspace resource manager and access broker tpm2-abrmd [3] used for multiplexing parallel access to a TPM device. - after installing all three of the mentioned tpm2 packages on openSUSE, arbitrary local users may issue arbitrary commands to the TPM chip [4], including a `tpm2_clear` operation - I generally agree with upstream in that properly setup TPM level authorization will prevent any local DoS issues - Tests on other Linux distributions like Debian or Fedora show that they exhibit the same behaviour when all three mentioned tpm2 packages are installed - integrators might want to reduce the level of surprise for some of their users. This can be done relatively simple by restricting the D-Bus level access to members of a separate group, for example. Upstream recommends *not* to use the same 'tss' group for this - Upstream stresses the point that this is not a known vulnerability Nothing to do yet, so we will have to leave this floating with Bugsquad for the moment. We offer these relevant TPM2 pkgs: lib64tpm2-tss-devel tpm2-abrmd tpm2-tools tpm2-tss
Keywords: (none) => UPSTREAMCC: (none) => lewyssmith, tmb
(In reply to Lewis Smith from comment #1) > > Nothing to do yet, so we will have to leave this floating with Bugsquad for > the moment. > We offer these relevant TPM2 pkgs: > lib64tpm2-tss-devel > tpm2-abrmd > tpm2-tools > tpm2-tss CC'ing their registered maintainers, though
CC: (none) => geiger.david68210, marja11, thierry.vignaud
@Luigi What should we do? Put this in M9 ERRATA?
The maintainers will have to determine how this impacts Mageia and what should be done about it.
In which case, can we assign it to pkg-bugs? Nothing to be gained by Bugsquad sitting on it.
(In reply to Lewis Smith from comment #5) > In which case, can we assign it to pkg-bugs? Nothing to be gained by > Bugsquad sitting on it. tv is the registered maintainer now, but daviddavid updated the package in May, with a reference to: fix DBus policy location (rhbz #1955150) It is too late to look for other updates since this bug was filed. Assigning to the registered maintainer, in case more needs to be fixed and/or for Mageia 8
Assignee: bugsquad => thierry.vignaud