Stefanberger

**Name of the Vulnerable Software and Affected Versions** libtpms versions 0.10.0 through 0.10.1 **Description** libtpms, a library providing software emulation of a Trusted Platform Module, contains a flaw impacting data confidentiality. When integrated with OpenSSL 3.x, the library incorrectly returns the initial Initialization Vector (IV) instead of the last IV during symmetric cipher operations. This weakens encryption and decryption processes. **Recommendations** Update to version 0.10.2 or later.

**Name of the Vulnerable Software and Affected Versions** Libtpms versions prior to 0.7.12 Libtpms versions prior to 0.8.10 Libtpms versions prior to 0.9.7 Libtpms versions prior to 0.10.1 **Description** The issue is an out-of-bounds read vulnerability in the `CryptHmacSign` function. This occurs when there is an inconsistent pairing of the `signKey` and `signScheme` parameters, where the `signKey` is `ALG KEYEDHASH` key and `inScheme` is an ECC or RSA scheme. The vulnerability can be triggered by sending malicious commands to a TPM 2.0/vTPM whose firmware is based on an affected TCG reference implementation, potentially making a vTPM unavailable to a VM. **Recommendations** For versions prior to 0.7.12, update to version 0.7.12 or later. For versions prior to 0.8.10, update to version 0.8.10 or later. For versions prior to 0.9.7, update to version 0.9.7 or later. For versions prior to 0.10.1, update to version 0.10.1 or later. As a temporary workaround, consider restricting access to the `CryptHmacSign` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** swtpm versions prior to 0.5.3 swtpm versions prior to 0.6.2 swtpm versions prior to 0.7.1 **Description** The issue is related to an out-of-bounds read in the swtpm TPM emulator. This can be caused by a specially crafted header of swtpm's state, where the `blobheader`'s `hdrsize` indicator has an invalid value, leading to an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. **Recommendations** To resolve the issue, users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. As a temporary workaround, there are currently no known workarounds.