PT-2023-6784 · Tpm2-Tss+10 · Tpm2-Tss+10
Fergus-Dall
·
Published
2023-01-19
·
Updated
2025-11-21
·
CVE-2023-22745
CVSS v3.1
6.4
Medium
| Vector | AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
tpm2-tss versions (affected versions not specified)
Description
The issue is related to the
Tss2 RC SetHandler and Tss2 RC Decode functions in the tpm2-tss implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). These functions index into the layer handler array with an 8-bit layer number, but the array only has TPM2 ERROR TSS2 RC LAYER COUNT entries. This can cause a buffer overrun when trying to add a handler for higher-numbered layers or decode a response code with such a layer number, potentially resulting in arbitrary code execution. An example attack could be a Man-in-the-Middle (MiTM) bus attack that returns 0xFFFFFFFF for the response code. The attacker must have local access to the target machine with local system privileges, which typically requires administrative privilege.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Suse
Ubuntu
Tpm2-Tss