PT-2021-11033 · Tpm2-Tss+1 · Tpm2-Tss+1

Published 2020-10-08 · Updated 2024-06-15 · CVE-2020-24455

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: tpm2-tss versions prior to 3.0.1 tpm2-tss versions prior to 2.4.3

Description: A missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access.

Recommendations: For versions prior to 3.0.1, update to version 3.0.1 or later. For versions prior to 2.4.3, update to version 2.4.3 or later.

Fix

Weakness Enumeration

CWE-909

Related Identifiers

ALT-PU-2020-2974

ALT-PU-2020-3052

ALT-PU-2021-3466

ALT-PU-2021-4848

AZL-6924

CVE-2020-24455

MGASA-2020-0417

OESA-2021-1016

OPENSUSE-SU-2024:11470-1

Affected Products

Alt Linux

Tpm2-Tss

References · 21

• https://osv.dev/vulnerability/MGASA-2020-0417 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1902167 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/KBRTMYDRPQBDGNADVXGI745WGT2MGVOO · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-24455 · Vendor Advisory
• https://security.gentoo.org/glsa/202107-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24455 · Security Note
• https://osv.dev/vulnerability/OESA-2021-1016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24455 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0417.html · Security Note
• https://osv.dev/vulnerability/AZL-6924 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24455 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KPOENCMJU4DMT3BDNUBRK25B3DJ47UO · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11470-1 · Vendor Advisory
• https://github.com/tpm2-software/tpm2-tss/releases/tag/3.0.1 · Note
• https://github.com/tpm2-software/tpm2-tss/releases/tag/2.4.3 · Note