CVE-2023-22745
published 2023-01-19CVE-2023-22745: tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions…
PriorityP431medium6.4CVSS 3.1
AVLACHPRHUINSUCHIHAH
EPSS
0.52%
41.3th percentile
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tpm2-tss | < tpm2-tss 3.2.1-3 (bookworm) | tpm2-tss 3.2.1-3 (bookworm) |
| msrc | cbl2_tpm2-tss_2.4.6-2_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_tpm2-tss_2.4.6-2_on_cbl_mariner_1.0 | — | — |
| tpm2-software | tpm2-tss | < 4.0.1 | 4.0.1 |
| tpm2-software | tpm2-tss | < 3.2.2-rc0 | 3.2.2-rc0 |
| tpm2-software | tpm2-tss | >= 0 < 3.2.1-3 | 3.2.1-3 |
| tpm2-software | tpm2-tss | >= 0 < 3.2.1-3 | 3.2.1-3 |
| tpm2-software | tpm2-tss | >= 0 < 3.2.1-3 | 3.2.1-3 |
| tpm2-software | tpm2-tss | >= 0 < 2.3.2-1ubuntu0.20.04.2 | 2.3.2-1ubuntu0.20.04.2 |
| tpm2-software | tpm2-tss | >= 0 < 3.2.0-1ubuntu1.1 | 3.2.0-1ubuntu1.1 |
| tpm2-software | tpm2-tss | >= 0 < 4.0.1-7.1ubuntu5.1 | 4.0.1-7.1ubuntu5.1 |
| tpm2_software_stack_project | tpm2_software_stack | < 3.2.2 | 3.2.2 |
| tpm2_software_stack_project | tpm2_software_stack | >= 4.0.0 < 4.1.0 | 4.1.0 |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
osv6.4MEDIUM
vendor_debian6.4MEDIUM
vendor_msrc6.4MEDIUM
vendor_redhat6.4MEDIUM
vendor_ubuntu6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
TPM2 Software Stack vulnerabilities
vendor_ubuntu·2024-05-29·CVSS 6.4
CVE-2023-22745 [MEDIUM] TPM2 Software Stack vulnerabilities
Title: TPM2 Software Stack vulnerabilities
Summary: Several security issues were fixed in TPM2 Software Stack.
Fergus Dall discovered that TPM2 Software Stack did not properly handle
layer arrays. An attacker could possibly use this issue to cause
TPM2 Software Stack to crash, resulting in a denial of service, or
possibly execute arbitrary code.
(CVE-2023-22745)
Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not
validate the quote data after deserialization. An attacker could generate
an arbitrary quote and cause TPM2 Software Stack to have unknown behavior.
(CVE-2024-29040)
Instructions: In general, a standard system update will make all the necessary changes.
CISA ICS
Siemens SCALANCE XCM-/XRM-300
cisa_ics·2024-02-15
Siemens SCALANCE XCM-/XRM-300
ICS Advisory
##
Siemens SCALANCE XCM-/XRM-300
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-11
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SCALANCE XCM-/XRM-300
- Vulnerabilities: Out-of-bounds Write, Incorrect Type Conversion or Cast, Improper Verification of Cryptographic Signature, Improper Access Control, Improper Authentication, Missing Encryption
Red Hat
tpm2-tss: Buffer Overlow in TSS2_RC_Decode
vendor_redhat·2023-01-20·CVSS 6.4
CVE-2023-22745 [MEDIUM] CWE-120 tpm2-tss: Buffer Overlow in TSS2_RC_Decode
tpm2-tss: Buffer Overlow in TSS2_RC_Decode
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with
Microsoft
Buffer Overlow in TSS2_RC_Decode in tpm2-tss
vendor_msrc·2023-01-10·CVSS 6.4
CVE-2023-22745 [MEDIUM] CWE-120 Buffer Overlow in TSS2_RC_Decode in tpm2-tss
Buffer Overlow in TSS2_RC_Decode in tpm2-tss
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micr
Debian
CVE-2023-22745: tpm2-tss - tpm2-tss is an open source software implementation of the Trusted Computing Grou...
vendor_debian·2023·CVSS 6.4
CVE-2023-22745 [MEDIUM] CVE-2023-22745: tpm2-tss - tpm2-tss is an open source software implementation of the Trusted Computing Grou...
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access
OSV
tpm2-tss vulnerabilities
osv·2024-05-29·CVSS 6.4
CVE-2023-22745 [MEDIUM] tpm2-tss vulnerabilities
tpm2-tss vulnerabilities
Fergus Dall discovered that TPM2 Software Stack did not properly handle
layer arrays. An attacker could possibly use this issue to cause
TPM2 Software Stack to crash, resulting in a denial of service, or
possibly execute arbitrary code.
(CVE-2023-22745)
Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not
validate the quote data after deserialization. An attacker could generate
an arbitrary quote and cause TPM2 Software Stack to have unknown behavior.
(CVE-2024-29040)
OSV
CVE-2023-22745: tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2)
osv·2023-01-19·CVSS 6.4
CVE-2023-22745 [MEDIUM] CVE-2023-22745: tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2)
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabfhttps://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67
2023-01-19
Published