CVE-2024-36477

What it actually does

Failure to include the 4-byte SPI header size when computing MAX_SPI_FRAMESIZE causes the TPM SPI transfer buffer to be undersized, resulting in out-of-bounds memory accesses during SPI frame handling in the Linux kernel tpm_tis_spi driver.

Why it matters to the business

Local memory corruption on Linux systems using TPM-over-SPI can enable privilege escalation or denial of service; the issue affects a wide range of kernels and devices but carries low exploitation probability and no known ransomware campaigns.

How an attack unfolds

An attacker with local user access triggers TPM SPI transfers that rely on the undersized buffer; the missing header accounting produces an out-of-bounds write or read, confirmed via KASAN, which may be chained for further kernel compromise.

How to fix it

Apply the upstream fix that introduces SPI_HDRSIZE and updates buffer allocation (commit 1547183852dcdfcc25878db7dd3620509217b0cd) or upgrade to a kernel containing this change; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Verify the presence of the SPI_HDRSIZE definition and updated buffer sizing logic in the tpm_tis_spi source; run KASAN-enabled kernels under TPM SPI workloads to confirm absence of out-of-bounds reports.

Typical attack path

1. Obtain local shell or process execution on the target Linux system
2. Interact with the TPM SPI character device or trigger kernel TPM operations
3. Cause allocation of the undersized transfer buffer
4. Trigger SPI frame handling that writes beyond the buffer boundary
5. Leverage resulting memory corruption for privilege escalation or crash

How to detect it

Search kernel logs and KASAN reports for tpm_tis_spi buffer allocation warnings or out-of-bounds accesses; inspect boot and dmesg output around TPM initialization for related stack traces.

What your security team should do

• Prioritize kernel updates containing commit 1547183852dcdfcc25878db7dd3620509217b0cd on all systems exposing TPM-over-SPI
• Monitor vendor advisories for backported fixes in distribution kernels
• Limit local access to TPM devices where feasible until patches are applied
• Include tpm_tis_spi paths in future kernel fuzzing and KASAN testing