Add caller-supplied policy authorization for firmware upgrade - #560

src/tpm2_wrap.c:11213

• Severity: Critical (CWE-121/CWE-476). tpm2_ifx_firmware_start() builds a command in a fixed-size stack buffer (TPM_SHA512_DIGEST_SIZE) and copies manifest_hash using manifest_hash_sz without validating it. Through the public wolfTPM2_FirmwareUpgradeHash_ex() API a caller can pass a larger size (or a non-NULL size with NULL manifest_hash), causing a stack overflow or NULL dereference. Validate manifest_hash pointer and size against hashAlg before constructing the command.

    int rc;
    WOLFTPM2_SESSION tpmSession;
    TPM_HANDLE sessionHandle = TPM_RH_NULL;
    int ownSession = 0;

    XMEMSET(&tpmSession, 0, sizeof(tpmSession));

src/tpm2_wrap.c:10739

• Severity: Medium (CWE-20). wolfTPM2_SetPrimaryPolicy() accepts authPolicySz > 0 with authPolicy == NULL, which would silently send an empty policy digest (size=0) while still setting hashAlg. This is an argument-validation bug that can result in unexpected policy changes or confusing TPM errors; fail fast when a non-zero size is provided without a buffer (and when clearing, enforce hashAlg==TPM_ALG_NULL implies authPolicySz==0).

This issue also appears on line 11207 of the same file.

    if (dev == NULL) {
        return BAD_FUNC_ARG;
    }
    if (authPolicySz > (word32)sizeof(in.authPolicy.buffer)) {
        return BAD_FUNC_ARG;
    }

examples/firmware/firmware_policy.c:184

• Severity: Low (CWE-476). firmware_policy_session_setup() dereferences dev and session without checking for NULL (it calls wolfTPM2_IsAlgSupported(dev, ...) and XMEMSET(session,...)). Even though this is example code, it’s a shared helper and should fail cleanly with BAD_FUNC_ARG on NULL inputs.

    if (hsz == 0 || hsz > TPM_MAX_DIGEST_SIZE) {
        return BAD_FUNC_ARG;
    }
    XMEMSET(session, 0, sizeof(*session));
    XMEMSET(&orList, 0, sizeof(orList));

examples/firmware/st33_fw_update.c:425

• Severity: Low (CWE-772). In the ST33 example, sessionStarted is set to 1 before calling wolfTPM2_FirmwareUpgrade_ex(). If that call fails before FieldUpgradeStart is issued (e.g., comms/GetCapabilities failure), cleanup will skip UnloadHandle and leak the policy session. Consider only marking the session as “consumed” on overall success; if the TPM already consumed it on a later failure, UnloadHandle may fail harmlessly and is already ignored.

        if (rc == 0) {
            if (policyMode) {
                printf("Using caller-supplied policy session\n");
                /* session is handed to FieldUpgradeStart, which consumes it */
                sessionStarted = 1;
            }
            rc = wolfTPM2_FirmwareUpgrade_ex(&dev,
                fwinfo.manifest_buf, (uint32_t)fwinfo.manifest_bufSz,
                TPM2_ST33_FwData_Cb, &fwinfo,
                policyMode ? &policySession : NULL);

examples/firmware/ifx_fw_update.c:251

• Severity: Low (CWE-772). In the Infineon example, sessionStarted is set based only on caps.opMode before the upgrade call. If the upgrade fails before reaching FieldUpgradeStart (e.g., IO/GetCapabilities errors inside the library), cleanup will skip UnloadHandle and leak the policy session. Mark the session as “consumed” only when the overall call succeeds and the path actually reaches start (opMode != 0x03).

    if (rc == 0) {
        /* The upgrade hands the session to FieldUpgradeStart, which the TPM
         * consumes as it enters upgrade mode. opMode 0x03 (finalize-only) does
         * not reach start, so the session there is not consumed. */
        if (policyMode) {