CVE-2020-24455 — Missing Initialization of Resource in Software Stack Project Tpm2 Software Stack

CWE-909 — Missing Initialization of ResourceCWE-456 — Missing Initialization of a Variable6 documents6 sources
Severity
6.7MEDIUMNVD
EPSS
0.1%
top 72.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Tpm2-software Tpm2-tssTpm2 Software Stack Project Tpm2 Software StackDebian Tpm2-tss+7 more
Timeline
PublishedFeb 26
Latest updateMay 24

Description

Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages9 packages

▶debiandebian/tpm2-tss< tpm2-tss 3.0.1-1 (bookworm)
▶Debiantpm2-software/tpm2-tss< 3.0.1-1+3

Also affects: Fedora 34

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-qh4p-3mhw-2cp7: Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access↗2022-05-24
▶
OSV
CVE-2020-24455: Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access↗2021-02-26
▶

📋Vendor Advisories

3
Microsoft
Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4↗2021-02-09
▶
Red Hat
tpm2-tss: FAPI PolicyPCR not instatiating correctly↗2020-10-13
▶
Debian
CVE-2020-24455: tpm2-tss - Missing initialization of a variable in the TPM2 source may allow a privileged u...↗2020
▶