Skip to content
OpenAdvisories
Medium ELSA-2023-2453 2 CVEs

Moderate: libtpms security update (Oracle Linux 9)

Published May 15, 2023 · Updated May 15, 2023

Ecosystem: Oracle Linux

Summary

[0.9.1-3.20211126git1ff6fe1f43]
- Backport 'tpm2: Check size of buffer before accessing it' (CVE-2023-1017 & CVE-2023-1018)
Resolves: rhbz#2173960
Resolves: rhbz#2173967

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 libtpms 0:0.9.1-3.20211126git1ff6fe1f43.el9_2

Vulnerabilities 2

  • Medium 5.5
    CVE-2023-1018

    TPM2.0 vulnerable to out-of-bounds read

    An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive dat…

    Trusted Computing Group TPM2.0 libtpms libtpms Debian Ubuntu
  • Unscored —
    CVE-2023-1017

    TPM2.0 vulnerable to out-of-bounds write

    An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of …

    Trusted Computing Group TPM2.0 libtpms libtpms Debian Ubuntu