Skip to content

[AutoPR- Security] Patch swtpm for CVE-2026-75900 [MEDIUM] #18541

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Azure Linux Security Servicing Account (azurelinux-security) wants to merge 1 commit into
base: 3.0-dev
Choose a base branch
from
+46 −1
Draft

[AutoPR- Security] Patch swtpm for CVE-2026-75900 [MEDIUM] #18541

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions SPECS/swtpm/CVE-2026-75900.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
From d7f0a8a1656c3189652caf0483d3f1998d739d4e Mon Sep 17 00:00:00 2001
From: Suraj Theekshana <surajtheekshanahackerone@gmail.com>
Date: Fri, 14 Aug 2026 02:34:48 +0000
Subject: [PATCH] swtpm: Fix length check in SWTPM_NVRAM_CheckHeader()

The length of an incoming blob was compared against sizeof(bh), which is
the size of the blobheader pointer rather than the size of the structure.
blobheader is packed and 10 bytes wide, so on 64-bit builds a blob of 8
bytes passed the check and the subsequent read of bh->totlen, which
occupies offsets 6-9, accessed 2 bytes beyond the buffer. On 32-bit builds
the check admitted 4 bytes and the overread was 6.

A blob of this length can be supplied via CMD_SET_STATEBLOB, where
ctrlchannel_receive_state() allocates exactly the length the client
declares.

Fixes: CVE-2026-75900

Signed-off-by: Suraj Theekshana <surajtheekshanahackerone@gmail.com>
Signed-off-by: rpm-build <rpm-build>
Upstream-reference: https://github.com/stefanberger/swtpm/commit/dc5f5ee3d8261a4d9814ad5da69164a118822401.patch
---
src/swtpm/swtpm_nvstore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/swtpm/swtpm_nvstore.c b/src/swtpm/swtpm_nvstore.c
index ff5cb80..eeb55ba 100644
--- a/src/swtpm/swtpm_nvstore.c
+++ b/src/swtpm/swtpm_nvstore.c
@@ -1097,7 +1097,7 @@ SWTPM_NVRAM_CheckHeader(unsigned char *data, uint32_t length,
blobheader *bh = (blobheader *)data;
uint16_t hdrsize;

- if (length < sizeof(bh)) {
+ if (length < sizeof(*bh)) {
if (!quiet)
logprintf(STDERR_FILENO,
"not enough bytes for header: %u\n", length);
--
2.45.4

6 changes: 5 additions & 1 deletion SPECS/swtpm/swtpm.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,13 @@
Summary: TPM Emulator
Name: swtpm
Version: 0.8.1
Release: 5%{?dist}
Release: 6%{?dist}
License: BSD-3-Clause
URL: http://github.com/stefanberger/swtpm
Vendor: Microsoft Corporation
Distribution: Azure Linux
Source0: %{url}/archive/%{gitcommit}/%{name}-%{gitshortcommit}.tar.gz
Patch0: CVE-2026-75900.patch

BuildRequires: make
BuildRequires: git-core
Expand Down Expand Up @@ -193,6 +194,9 @@ fi
%{_datadir}/swtpm/swtpm-create-tpmca

%changelog
* Fri Aug 21 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.8.1-6
- Patch for CVE-2026-75900

* Tue Sep 03 2024 Neha Agarwal <nehaagarwal@microsoft.com> - 0.8.1-5
- Add missing Vendor and Distribution tags.

Expand Down
Loading