Trusted Computing Group tpm2-tss Tss2_RC_SetHandler/Tss2_RC_Decode buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Trusted Computing Group tpm2-tss. This issue affects the function Tss2_RC_SetHandler/Tss2_RC_Decode. This manipulation causes buffer overflow. This vulnerability is registered as CVE-2023-22745. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability classified as critical was found in Trusted Computing Group tpm2-tss (affected version not known). Affected by this vulnerability is the function Tss2_RC_SetHandler/Tss2_RC_Decode. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.

The weakness was published 01/20/2023 as GHSA-4j3v-fh23-vx67. The advisory is shared at github.com. This vulnerability is known as CVE-2023-22745 since 01/06/2023. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 236580 (Alibaba Cloud Linux 3 : 0006: tpm2-tss (ALINUX3-SA-2024:0006)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 306490c8d848c367faa2d9df81f5e69dab46ffb5 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (236580) and CERT Bund (WID-SEC-2023-2853). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source CentOS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• Red Hat OpenShift
• Meinberg LANTIME

Productinfo

Vendor

• Trusted Computing Group

Name

• tpm2-tss

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion