PT-2023-1651 · Tpm2.0+8 · Tpm2.0+8

Francisco Falcon · Publicado 2023-02-28 · Atualizado 2024-11-29 · CVE-2023-1017

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TPM2.0 (affected versions not specified)

Description An out-of-bounds write vulnerability exists in TPM2.0's Module Library, allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. This can lead to denial of service, causing the TPM chip or process to crash or become unusable, and/or arbitrary code execution in the TPM context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALSA-2023:2453

ALT-PU-2023-1896

ALT-PU-2023-1933

ALT-PU-2024-14805

BDU:2023-01188

CVE-2023-1017

MGASA-2023-0102

OESA-2023-1299

OPENSUSE-SU-2024:12763-1

RHSA-2023:1833

RHSA-2023:2453

RHSA-2023_2453

SUSE-SU-2023:2051-1

SUSE-SU-2023_2051-1

USN-5933-1

Produtos afetados

Alt Linux

Almalinux

Linuxmint

Red Hat

Red Os

Suse

Tpm2.0

Ubuntu

Windows

Referências · 54

• https://security-tracker.debian.org/tracker/CVE-2023-1017 · Aviso do Fabricante
• https://launchpad.net/bugs/2009608 · Nota
• https://cve.org/CVERecord?id=CVE-2023-1017 · Nota de Segurança
• https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2023-2453.html · Aviso do Fabricante
• https://t.me/avleonovcom/1089 · Publicação no Telegram
• https://t.me/pentestingnews/33567 · Publicação no Telegram
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://suse.com/security/cve/CVE-2023-1017.html · Nota
• https://osv.dev/vulnerability/CVE-2023-1017 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2023:2051-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-1018 · Nota
• https://bugzilla.suse.com/1206022 · Nota
• https://ubuntu.com/security/CVE-2023-1017 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1017 · Aviso do Fabricante