PT-2021-4274 · Libtpms · Libtpms

Mauro Matteo Cascella · Published 2021-06-03 · Updated 2022-10-07 · CVE-2021-3569

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libtpms versions prior to 0.7.2 libtpms versions prior to 0.8.0

Description A stack corruption bug was found in libtpms while decrypting data using RSA, which could result in a SIGBUS (bad memory access) and termination of swtpm. The highest threat from this issue is to system availability. It could allow an attacker to cause a denial of service.

Recommendations For versions prior to 0.7.2, update to version 0.7.2 or later. For versions prior to 0.8.0, update to version 0.8.0 or later.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-119

CWE-787

Related Identifiers

BDU:2021-04882

CVE-2021-3569

Affected Products

Libtpms

References · 13

• https://osv.dev/vulnerability/CVE-2021-3569 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3569 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-3569 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1964358 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3569 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04882 · Security Note
• https://ubuntu.com/security/CVE-2021-3569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3569 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3569 · Vendor Advisory
• https://github.com/stefanberger/libtpms/commit/505ef841c00b4c096b1977c667cb957bec3a1d8b · Note
• https://github.com/stefanberger/libtpms/commit/40cfe134c017d3aeaaed05ce71eaf9bfbe556b16 · Note
• https://t.me/cvenotify/16277 · Telegram Post
• https://t.me/cvenotify/15500 · Telegram Post