Log in Start free

Vulnerability · Published Feb 27, 2024 · Assigned by Linux

CVE-2021-46922KEYS: trusted: Fix TPM reservation for seal/unseal

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 84.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM reservation for seal/unseal The original patch 8c657a0590de ("KEYS: trusted: Reserve TPM for seal and unseal operations") was correct on the mailing list: https://lore.kernel.org/linux-integrity/20210128235621.127925-4-jarkko@kernel.org/ But somehow got rebased so that the tpm_try_get_ops() in tpm2_seal_trusted() got lost. This causes an imbalanced put of the TPM ops and causes oopses on TIS based hardware. This fix puts back the lost tpm_try_get_ops()

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.10.38-1DEBIAN-CVE-2021-46922
Debian:13linux5.10.38-1DEBIAN-CVE-2021-46922
Debian:14linux5.10.38-1DEBIAN-CVE-2021-46922
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2021-46922
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2021-46922

Affected products (as reported)

VendorProductVersions
Linux Linux 67118bb78d72aab5b831f054a74ae856339a1974 – before bf84ef2dd2ccdcd8f2658476d34b51455f970ce4498b8fc1cdc13b57b02dd28544b18323900fae10 – before 39c8d760d44cb3fa0d67e8cd505df81cf4d809998c657a0590de585b1115847c17b34a58025f2f4b – before 9d5171eab462a63e2fbebfccf6026e92be018f20
Linux Linux 5.10.20 – before 5.10.335.11.3 – before 5.11.17

References