Skip to content
OpenAdvisories
Medium · 6.4 CVE-2023-22745 EUVD-2023-26863

Buffer Overlow in TSS2_RC_Decode in tpm2-tss

Published Jan 19, 2023 · Updated Nov 21, 2025 · Assigned by GitHub_M

Vendor: tpm2-software Product: tpm2-tss Package: tpm2-tss Package: tpm2-tss Package: tpm2-tss Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.

Affected products

VendorProductAffectedFixed
tpm2-software tpm2-tss < 4.0.1, < 3.2.2-rc0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tpm2-tss 3.2.1-3 —
Debian 13 tpm2-tss 3.2.1-3 —
Debian 12 tpm2-tss 3.2.1-3 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS tpm2-tss 4.0.1-7.1ubuntu5.1 USN-6796-1
Ubuntu 22.04 LTS tpm2-tss 3.2.0-1ubuntu1.1 USN-6796-1
Ubuntu 20.04 LTS tpm2-tss 2.3.2-1ubuntu0.20.04.2 USN-6796-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 tpm2-tss +1 3.2.2-2.el9 RHSA-2023:6685
RHEL 8 tpm2-tss +1 2.3.2-5.el8 RHSA-2023:7166
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.8 EUS tpm2-tss +1 2.3.2-5.el8_8 RHSA-2024:4739
RHEL 8.6 TUS tpm2-tss +1 2.3.2-5.el8_6 RHSA-2024:4408
RHEL 8.6 E4S tpm2-tss +1 2.3.2-5.el8_6 RHSA-2024:4408
RHEL 8.6 AUS tpm2-tss +1 2.3.2-5.el8_6 RHSA-2024:4408

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 tpm2-tss +1 3.2.2-2.el9 ALSA-2023:6685
AlmaLinux 8 tpm2-tss +1 2.3.2-5.el8 ALSA-2023:7166

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 tpm2-0-tss 3.1.0-150400.3.3.1 SUSE-SU-2023:0526-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Real Time 15 SP3 tpm2-0-tss 2.4.5-150300.3.6.1 SUSE-SU-2023:0613-1
SLE Micro 5.3 tpm2-0-tss 3.1.0-150400.3.3.1 SUSE-SU-2023:0526-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.4 tpm2-0-tss 2.4.5-150300.3.6.1 SUSE-SU-2023:0613-1, SUSE-SU-2023:0526-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.3 tpm2-0-tss 3.1.0-150400.3.3.1 SUSE-SU-2023:0526-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tpm2-tss +1 3.1.0-1.amzn2023.0.3 ALAS2023-2023-110

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 tpm2-tss 4.0.1-1 —
Azure Linux 2 (CBL-Mariner) tpm2-tss 2.4.6-2 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 tpm2-tss +1 3.2.2-2.el9 ELSA-2023-6685
Oracle Linux 8 tpm2-tss +1 2.3.2-5.el8 ELSA-2023-7166

Advisories 19

References