CVE-2022-23645

Published: 18 February 2022

swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
swtpm Launchpad, Ubuntu, Debian	jammy	Not vulnerable (0.6.3-0ubuntu3)
	trusty	Ignored (end of standard support)
	upstream	Released (0.6.2)
	xenial	Ignored (end of standard support)
	Patches: upstream: https://github.com/stefanberger/swtpm/commit/9f740868fc36761de27df3935513bdebf8852d19

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›