CVE-2022-23645 — Out-of-bounds Read in Swtpm

Vendor	Product	Version range	Fixed in
debian	swtpm	< swtpm 0.7.1-1 (bookworm)	swtpm 0.7.1-1 (bookworm)
fedoraproject	fedora	—	—
redhat	enterprise_linux	—	—
stefanberger	swtpm	< 0.5.3	0.5.3
stefanberger	swtpm	—	—
stefanberger	swtpm	—	—
swtpm_project	swtpm	< 0.5.3	0.5.3
swtpm_project	swtpm	—	—
swtpm_project	swtpm	—	—
swtpm_project	swtpm	>= 0 < 0.7.1-1	0.7.1-1
swtpm_project	swtpm	>= 0 < 0.7.1-1	0.7.1-1
swtpm_project	swtpm	>= 0 < 0.7.1-1	0.7.1-1
swtpm_project	swtpm	>= 0.6.0 < 0.6.2	0.6.2
virt_rhel	swtpm	—	—

Red Hat

swtpm: swtpm: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch

vendor_redhat·2026-08-19·CVSS 5.5

CVE-2026-75900 [MEDIUM] CWE-125 swtpm: swtpm: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch swtpm: swtpm: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log. Statement: Red Hat rates this issue as Moderate impact. The SWTPM_NVRAM_CheckHeader() function in swtpm uses sizeof(bh) where bh is a pointer, checking buffer length against 8 bytes (on 64-bit) instead of the 10-byte packed

Red Hat

swtpm: Unchecked header size indicator against expected size

vendor_redhat·2022-02-18·CVSS 6.2

CVE-2022-23645 [MEDIUM] CWE-125 swtpm: Unchecked header size indicator against expected size swtpm: Unchecked header size indicator against expected size swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. An out-of-bounds read vulnerability was found in swtpm. The vulnerability exists due to a boundary condition when the byte array representin

Debian

CVE-2022-23645: swtpm - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux C...

vendor_debian·2022·CVSS 6.2

CVE-2022-23645 [MEDIUM] CVE-2022-23645: swtpm - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux C... swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. Scope: local bookworm: resolved (fixed in 0.7.1-1) forky: resolved (fixed in 0.7.1-1) sid: resolved (fixed in 0.7.1-1) trixie: resolved (fixed in 0.7.1-1)

OSV

CVE-2022-23645: swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface

osv·2022-02-18·CVSS 5.5

CVE-2022-23645 [MEDIUM] CVE-2022-23645: swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.

CVE-2022-23645: swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to…

Affected

CVSS provenance