Описание
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.
An out-of-bounds write vulnerability was found in the TPM 2.0's Module Library, which allows the writing of 2-byte data after the end of the TPM command. This flaw may lead to a denial of service or arbitrary code execution within the libtpms scope.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | virt:rhel/libtpms | Affected | ||
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:8.2/libtpms | Will not fix | ||
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:8.3/libtpms | Will not fix | ||
| Red Hat Enterprise Linux 8 Advanced Virtualization | virt:av/libtpms | Will not fix | ||
| Red Hat Enterprise Linux 8.6 Extended Update Support | virt-devel | Fixed | RHSA-2023:1833 | 18.04.2023 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | virt | Fixed | RHSA-2023:1833 | 18.04.2023 |
| Red Hat Enterprise Linux 9 | libtpms | Fixed | RHSA-2023:2453 | 09.05.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.1 High
CVSS3
Связанные уязвимости
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.
CERT/CC: CVE-2023-1017 TPM2.0 Module Library Elevation of Privilege Vulnerability
An out-of-bounds write vulnerability exists in TPM2.0's Module Library ...
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.
EPSS
7.1 High
CVSS3