PT-2021-21674 · Libtpms+2 · Libtpms+2

Guilherme De Almeida Suckevicz · Published 2021-09-09 · Updated 2022-06-02 · CVE-2021-3746

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libtpms versions prior to 0.8.5 libtpms versions prior to 0.7.9 libtpms versions prior to 0.6.6

Description A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The issue is triggered by specially-crafted TPM2 command packets that affect the state of the TPM2's volatile state when written. The highest threat from this issue is to system availability.

Recommendations For versions prior to 0.8.5, update to version 0.8.5 or later. For versions prior to 0.7.9, update to version 0.7.9 or later. For versions prior to 0.6.6, update to version 0.6.6 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2021-3175

CVE-2021-3746

MGASA-2021-0590

OESA-2022-1695

OPENSUSE-SU-2021:3004-1

OPENSUSE-SU-2021_3004-1

OPENSUSE-SU-2024:11004-1

SUSE-SU-2021:3004-1

SUSE-SU-2021:3004-2

SUSE-SU-2021_3004-1

Affected Products

Alt Linux

Suse

Libtpms

References · 30

• https://osv.dev/vulnerability/OESA-2022-1695 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/7UCZ7AV2UKWYYCNZ2NLLXW7QYCX7K337 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3746 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3746 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3746 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/DZI42OR3JUEGWRKEVCOHL2FPTJVYCYBT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/YVJSXDXD44WDR4VA2XL33IZDJTBGRXP7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3746 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3746 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3746 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:3004-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0590.html · Security Note
• https://ubuntu.com/security/CVE-2021-3746 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/Z7KZSYMTE7Z4BBEZUWO2DIMQDWMGEP46 · Vendor Advisory