CVE-2024-42255

What it actually does

Null pointer dereference in tpm_buf_check_hmac_response() when TCG_TPM2_HMAC is enabled and tpm2_sessions_init() was never called, because auth is dereferenced before its NULL check succeeds.

Why it matters to the business

Kernel panic or system crash on affected Linux distributions when TPM2 HMAC sessions are used without prior initialization, leading to denial of service and potential loss of availability for dependent services.

How an attack unfolds

An attacker triggers a code path that reaches tpm_buf_check_hmac_response() on a system where TCG_TPM2_HMAC is compiled in but tpm2_sessions_init() has not run; the missing NULL guard allows dereference of an uninitialized pointer, causing an immediate oops or panic.

How to fix it

Upgrade the Linux kernel to version 6.10.1 or later, or apply the stable backports b9afbb9a0c734197c59c43610071041044bf1562. Rebuild and reboot all affected systems; verify TPM2 functionality after the update.

How to confirm the fix worked

Confirm the running kernel reports version 6.10.1 or newer; inspect the source for the corrected NULL check in tpm_buf_check_hmac_response() and test TPM2 HMAC operations on a non-initialized system to ensure no crash occurs.

Typical attack path

1. Identify a Linux kernel with TCG_TPM2_HMAC enabled and no prior TPM2 session initialization
2. Cause a TPM command that invokes tpm_buf_check_hmac_response() before tpm2_sessions_init() completes
3. Trigger NULL dereference leading to kernel panic

How to detect it

Search kernel logs for oops or panic messages containing tpm_buf_check_hmac_response or tpm2_sessions_init around the time of unexpected reboots; correlate with TPM2 device activity in dmesg or journalctl.

What your security team should do

• Prioritize kernel upgrade to 6.10.1 on all production systems within the next maintenance window
• Audit kernel configs for TCG_TPM2_HMAC usage and ensure tpm2_sessions_init() is called early in boot
• Monitor for kernel oops reports referencing tpm_buf_check_hmac_response after the patch window