Executive brief
The Linux kernel's ST33ZP24 Trusted Platform Module (TPM) driver contains a bug in its status checking function that fails to validate I2C transport reads. When the I2C read operation fails or returns incomplete data, the driver uses uninitialized stack memory as the TPM status instead of detecting the error. An attacker with local access could exploit this to manipulate TPM status flags, potentially bypassing security checks that rely on accurate TPM state reporting.
Technical details
The st33zp24_status() function in the ST33ZP24 TPM driver ignores the return value of the transport read operation (tpm_dev->ops->recv). When the I2C register-select write fails or when i2c_master_recv() is skipped due to a short/failed write, the data buffer remains uninitialized. The function returns this uninitialized stack value directly, allowing it to be misinterpreted as valid TPM_STS status flags. The fix validates that recv() returns exactly 1 byte, returning 0 (no flags set) on failure, forcing callers to retry or handle timeouts correctly instead of acting on invalid status. Exploitation requires local access to trigger I2C transport failures on systems with this TPM driver.
Affected products
- Linux Linux kernel multiple (prior to fix commit 8b92687708f5ef980de01c2042dbd76d11f78547)
Timeline
- 2026-09-17: disclosed: Published in NVD