PT-2025-16388 · Unknown+1 · Tpm2 Reference Library+1

Published 2025-04-15 · Updated 2025-05-06 · CVE-2025-1122

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google ChromeOS version 122.0.6261.132

Description The issue is related to an Out-Of-Bounds Write in the TPM2 Reference Library, allowing an attacker with root access to gain persistence and bypass operating system verification. This is achieved by exploiting the NV Read functionality during the Challenge-Response process.

Recommendations For Google ChromeOS version 122.0.6261.132, consider restricting access to the NV Read functionality until a patch is available. As a temporary workaround, limit the use of the Challenge-Response process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-05688

CVE-2025-1122

Affected Products

Google Chrome

Tpm2 Reference Library

References · 9

• 🔥 https://issuetracker.google.com/issues/324336238 · Exploit
• https://bdu.fstec.ru/vul/2025-05688 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-1122 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1122 · Vendor Advisory
• https://t.me/cvedetector/23012 · Telegram Post
• https://t.me/cvenotify/120913 · Telegram Post
• https://chromereleases.googleblog.com/2024/09 · Note
• https://issues.chromium.org/issues/b/324336238 · Note
• https://twitter.com/CVEnew/status/1912238693546328199 · Twitter Post