Harden fwTPM command processing

[aidangarske]

F-14018 - e04783c - Clear now commits replacement hierarchy seeds only after every random-number operation succeeds.

F-14020 - 8acf000 - A failed GlobalWriteLock operation now restores the previous lock state.

F-14021 - 7a450ab - Session parameter encryption and decryption failures are now returned to the caller.

F-14022 - fac7d24 - Small-stack allocation failures now retain their original error instead of continuing with invalid state.

F-14025 - 7a23828 - NV_SetBits now rejects command packets that end before the complete input is available.

F-14069 - b20df11 - NV counter, bit-field, and extend indices now require their TPM-defined data sizes.

F-14075 - b9af6bc - Policy command parsing now validates every sized buffer before reading it.

F-14407 - 8e2c941 - NV WRITE_STCLEAR access remains available until the startup-clear transition defined by the TPM state model.

F-14408 - 5dc6ce9 - PolicySigned now validates the nonce input before hashing or signature verification.

F-14409 - 49a1f68 - PolicySigned now rejects authorization handles that do not resolve to a supported entity.

F-14410 - 4af79b4 - Clear no longer erases PCR values that the TPM specification requires it to preserve.

F-14411 - a29ecfc - Clear now resets all TPM state owned by the command while preserving state outside its scope.

F-14412 - d32a80b - Startup and shutdown now track orderly state transitions correctly.

F-14413 - d7fe971 - ContextLoad now rejects restored sessions whose handle is already active.

F-14414 - 83eed37 - Keyed-hash objects now use their configured HMAC scheme instead of silently substituting another scheme.

F-14415 - 19e5735 - Event sequences now calculate and return digests for every allocated PCR bank.

F-14416 - ea20697 - RSA OAEP operations now preserve and use the caller-provided label.

F-14417 - ea2f8bc - Loaded objects now retain their authorization value.

F-14432 - b3ad443 - Policy commands now reject expiration forms the fwTPM does not implement.

F-14682 - bfbc47b - FlushContext now releases saved session state associated with the flushed handle.

F-14683 - c8d50ce - Failed NV counter persistence no longer exposes a counter value below the established high-water mark.

F-14685 - aaa3e58 - EvictControl validates an object before copying it into persistent storage.

F-14696 - 3dfb466 - CertifyCreation now requires and validates a matching creation ticket.

F-14697 - e9f0021 - Imported objects can no longer claim fixedTPM or fixedParent attributes.

F-14698 - 76ff8fd - Unsupported PIN-pass and PIN-fail NV index types are now rejected.

F-15704 - 88701cb - Bound entity authorization is no longer included twice when deriving a session HMAC key.

F-15705 - 8edab65 - PCR_Read now bounds the number of digest values written to its response list.

F-15706 - 4d86e8d - PCR event commands now extend only PCR banks that are currently allocated.

F-15707 - 2d59a2b - Dictionary-attack parameters are now checked against supported numeric limits.

F-15708 - 77e8bf6 - NV_Extend now returns hash initialization, update, and finalization failures.

F-15814 - 0142cf7 - StartAuthSession now rejects caller nonces that exceed the destination buffer.

F-15815 - 81a1654 - Session symmetric algorithm, key-size, and mode combinations are now validated before use.

F-15816 - 1c7daa5 - Salted session setup now normalizes cryptographic failures to the appropriate TPM error.

F-15817 - ece9620 - HMAC operations now validate that the selected key has a compatible type and scheme.

F-15818 - ff73e1d - Restricted keyed-hash objects can no longer be used for unsupported HMAC sequences.

F-15819 - 1997401 - Symmetric commands now reject cipher modes the fwTPM does not support.

F-15820 - 270dc16 - Symmetric encrypt and decrypt commands now enforce their required key and mode constraints.

F-15821 - 126ff80 - GetCapability now bounds TPM property groups and advances paginated property queries correctly.

F-15822 - 9f89069 - Command capability responses now report the correct NV usage attribute.

F-15823 - ba5b2d9 - Startup now resets platform authorization when required by the TPM state model.

F-15824 - 71c27e1 - Every Startup transition now flushes transient objects and sessions.

F-15825 - 17e8662 - ClockSet now applies the correct upper bound to the requested clock value.

F-15826 - 1a6c500 - Provisioning commands now return the correct handle error for invalid hierarchy handles.

F-15827 - 507f687 - Hash tickets are now checked against the hierarchy that generated them.

F-15828 - 2d3a6c1 - A sequence remains available when completion fails before consuming it.

F-15829 - eb94e14 - Context management commands now reject unsupported authorization sessions.

F-15830 - 8094860 - Invalid command handles now return the correctly indexed TPM handle-reference error.

F-15831 - 6ccac13 - Capability queries that require initialized state are now rejected before Startup.

F-15832 - e064db5 - PolicySigned and PolicyTicket now enforce expiration semantics, validate ticket fields, and prevent ticket replay across Clear.

F-15833 - 47b9a72 - PolicyLocality now rejects locality bits outside the TPM-defined range.

F-15834 - 20d55c2 - PolicyCommandCode now rejects commands unavailable in the current fwTPM build.

F-15836 - f483ae2 - Object creation now rejects contradictory or unsupported attribute combinations.

F-15837 - 8d20d56 - Attestation metadata is now obfuscated with the correct hierarchy proof and context-integrity hash.

F-15838 - 294ee40 - StirRandom now rejects input larger than the TPM-defined maximum.

F-15835 - 8b61c8b - PCR selection parsing now validates the selection count and every sizeofSelect value.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #629

Scan targets checked: wolftpm-src, wolftpm-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

[wolfSSL-Fenrir-bot]

Clear resets Clock without invalidating live policy-session timeouts, extending expired authorizations · Session/auth flaws

FwCmd_Clear now moves Clock back to 0, but live policy sessions keep their timeout and startTime values, which were recorded on the old Clock. The expiry check at line 21184 (pSess->timeout < FWTPM_Clock_GetMs(ctx)) therefore stays false for roughly the old Clock value, so time-limited PolicySigned/PolicyTicket authorizations remain usable far past their expiration.

Suggested fix: Needs a design decision: either flush or rebase every live policy session's timeout/startTime when Clear resets Clock, or measure session expiry on a time source that Clear does not reset (TPM 2.0 Part 1, Time vs. Clock).

Related known findings (similar but distinct; listed for context, not part of this finding)

• F-142: F-142 asked for Clear to reset Clock. This finding is about the side effect of doing that: session expiry is measured on the same Clock, so existing session deadlines are left far in the future instead of being invalidated or rebased.
• F-14411 (assigned): File/function: both are FwCmd_Clear, but the candidate's effect shows up in the session-expiry check (about line 21184), which F-14411 does not cover. Operation: F-14411 is the omission of a Clock reset on the success path. The candidate is the stale policy-session timeout/startTime values left behind once Clock is reset to 0. Root cause: F-14411 is a missing spec-mandated reset. The candidate is a missing session invalidation or rebase, or a time-source design problem, that appears only after the