mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-30 22:11:59 -09:00
e5d7805ea7
For more information about the release, see:
- https://github.com/tpm2-software/tpm2-tss/releases/tag/3.2.3
Fixes the following vulnerability:
- CVE-2024-29040
The JSON Quote Info returned by Fapi_Quote has to be deserialized by
Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field
`TPM2_GENERATED magic` of this structure any number can be used in the
JSON structure. The verifier can receive a state which does not
represent the actual, possibly malicious state of the device under test.
The malicious device might get access to data it shouldn't, or can use
services it shouldn't be able to.
For more information, see:
- https://nvd.nist.gov/vuln/detail/cve-2024-29040
- https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6
(cherry picked from commit 04533b70e6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
54 lines
1.7 KiB
Makefile
54 lines
1.7 KiB
Makefile
################################################################################
|
|
#
|
|
# tpm2-tss
|
|
#
|
|
################################################################################
|
|
|
|
TPM2_TSS_VERSION = 3.2.3
|
|
TPM2_TSS_SITE = https://github.com/tpm2-software/tpm2-tss/releases/download/$(TPM2_TSS_VERSION)
|
|
TPM2_TSS_LICENSE = BSD-2-Clause
|
|
TPM2_TSS_LICENSE_FILES = LICENSE
|
|
TPM2_TSS_CPE_ID_VENDOR = tpm2_software_stack_project
|
|
TPM2_TSS_CPE_ID_PRODUCT = tpm2_software_stack
|
|
TPM2_TSS_INSTALL_STAGING = YES
|
|
TPM2_TSS_DEPENDENCIES = openssl host-pkgconf
|
|
|
|
# 0001-configure-Only-use-CXX-when-fuzzing.patch
|
|
TPM2_TSS_AUTORECONF = YES
|
|
|
|
# Fixed in upstream commit
|
|
# https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf
|
|
TPM2_TSS_IGNORE_CVES += CVE-2023-22745
|
|
|
|
# systemd-sysusers and systemd-tmpfiles are only used at install time
|
|
# to trigger the creation of users and tmpfiles, which we do not care
|
|
# about at build time. groupadd, useradd, and setfacl are used in the
|
|
# fallback path when systemd-sysusers or systemd-tmpfiles are missing
|
|
# and their failure is ignored anyway.
|
|
TPM2_TSS_CONF_OPTS = \
|
|
ac_cv_prog_result_groupadd=yes \
|
|
ac_cv_prog_result_setfacl=yes \
|
|
ac_cv_prog_systemd_sysusers=no \
|
|
ac_cv_prog_systemd_tmpfiles=no \
|
|
ac_cv_prog_useradd=yes \
|
|
ac_cv_prog_groupadd=yes \
|
|
--with-crypto=ossl \
|
|
--disable-doxygen-doc \
|
|
--disable-defaultflags
|
|
|
|
# uses C99 code but forgets to pass -std=c99 when --disable-defaultflags is used
|
|
TPM2_TSS_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -std=c99"
|
|
|
|
ifeq ($(BR2_PACKAGE_TPM2_TSS_FAPI),y)
|
|
TPM2_TSS_DEPENDENCIES += json-c libcurl
|
|
TPM2_TSS_CONF_OPTS += --enable-fapi
|
|
else
|
|
TPM2_TSS_CONF_OPTS += --disable-fapi
|
|
endif
|
|
|
|
define TPM2_TSS_USERS
|
|
tss -1 tss -1 * - - - tss user for tpm2
|
|
endef
|
|
|
|
$(eval $(autotools-package))
|