From: Jason Gunthorpe Subject: Re: [RFC] tpm2-space: add handling for global session exhaustion Date: Fri, 27 Jan 2017 16:35:13 -0700 Message-ID: <20170127233513.GA28995@obsidianresearch.com> References: <1484772489.2396.2.camel@HansenPartnership.com> <1485554699.3229.20.camel@HansenPartnership.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <1485554699.3229.20.camel-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: tpmdd-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org To: James Bottomley Cc: tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Ken Goldman , linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: tpmdd-devel@lists.sourceforge.net On Fri, Jan 27, 2017 at 02:04:59PM -0800, James Bottomley wrote: > if I look at the code I've written, I don't know what the session > number is, I just save sessionHandle in a variable for later use (lets > say to v1). If I got the same session number returned at a later time > and placed it in v2, all I'd notice is that an authorization using v1 > would fail. Is there any way that could be used to cause an op thinking it is using v1 to authorize something it shouldn't? Jason ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot