[Bug 1970999] [NEW] Cannot load certificate stored in NVM

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Luca Boccassi (bluca):

[ Impact ]
Makes it impossible to use certain TPM functionality via openssl, more precisely extracting the TPM vendor certificate

[ Test Plan ]
Run the appropriate command on a machine with an affected TPM.

Before the fix:

root at jammy:/tmp# openssl x509 -provider tpm2 -provider default -in handle:0x1c0000a
WARNING:esys:src/tss2-esys/api/Esys_NV_Read.c:315:Esys_NV_Read_Finish() Received TPM Error 
ERROR:esys:src/tss2-esys/api/Esys_NV_Read.c:105:Esys_NV_Read() Esys Finish ErrorCode (0x000001c4) 
Could not read certificate from handle:0x1c0000a
40C70C33C37F0000:error:4000000C:tpm2::cannot load key::-1:452 tpm:parameter(1):value is out of range or is not correct for the context
Unable to load certificate

After the fix:

root at jammy:~# openssl x509 -provider tpm2 -provider default -in handle:0x1c0000a
-----BEGIN CERTIFICATE-----
MIIDBDCCAqmgAwIBAgIUBojh2fQZ3 <...>

[ Where problems could occur ]
Theoretically loading from NVM could be affected, but the fix is from upstream and no regressions due to this change have been reported in half a year.

[Original Description]
$ lsb_release -rd
Description:    Ubuntu 22.04 LTS
Release:        22.04

$ apt-cache policy tpm2-openssl
tpm2-openssl:
  Installed: 1.0.1-1
  Candidate: 1.0.1-1
  Version table:
 *** 1.0.1-1 500
        500 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        100 /var/lib/dpkg/status

Please see https://github.com/tpm2-software/tpm2-openssl/issues/35.

** Affects: tpm2-openssl (Ubuntu)
     Importance: Undecided
         Status: Confirmed

-- 
Cannot load certificate stored in NVM 
https://bugs.launchpad.net/bugs/1970999
You received this bug notification because you are a member of Ubuntu Sponsors Team, which is subscribed to the bug report.