Summary
The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.
Security Fix(es):
* tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017)
* tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | libtpms | 0.9.1-3.20211126git1ff6fe1f43.el9_2 |
Vulnerabilities 2
-
Medium 5.5
TPM2.0 vulnerable to out-of-bounds read
An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive dat…
-
Unscored —
TPM2.0 vulnerable to out-of-bounds write
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of …