Description
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Trusted Computing Group | TPM2.0 | < 1.83 | 1.83 |
Advisories 8
- SSA-628843 SSA-628843: Out of Bound Read Vulnerability in TPM 2.0 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2025-1278 AMD Prozessoren: Schwachstelle ermöglicht Denial of Service und Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 4, 2026
- WID-SEC-2025-1280 Intel Firmware: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 4, 2026
- ICSA-26-111-01 Siemens TPM 2.0 CISA ICS & IT advisories · Apr 21, 2026
- NCSC-2026-0112 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Apr 14, 2026
- WID-SEC-2025-2307 Microsoft Windows: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 25, 2025
- NCSC-2025-0357 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 11, 2025
- NCSC-2025-0310 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Oct 24, 2025