Out-of-bounds read in libtpms - CVE-2025-49133

Vulnerability identifier: #VU113442

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-49133

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the CryptHmacSign() function. A local user can trigger an out-of-bounds read error by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation and make vTPM (swtpm) unavailable to a VM.

libtpms
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
netcf
netcf-libs
netcf-devel
swtpm-tools-pkcs11
swtpm
swtpm-devel
swtpm-libs
swtpm-tools
libtpms
libtpms-debuginfo
libtpms-debugsource
libtpms-devel
libtpms (Red Hat package)
libtpms (Ubuntu package)
libtpms0-debuginfo
libtpms0
sgabios-bin
sgabios
libvirt-dbus
ruby-hivex
python3-hivex
perl-hivex
hivex
hivex-devel
ocaml-hivex-devel
ocaml-hivex
python3-libnbd
nbdfuse
libnbd-devel
libnbd
ocaml-libnbd
ocaml-libnbd-devel
libnbd-bash-completion
seavgabios-bin
seabios-bin
seabios
libiscsi-utils
libiscsi-devel
libiscsi
nbdkit-basic-plugins
nbdkit-tar-filter
nbdkit-ssh-plugin
nbdkit-server
nbdkit-python-plugin
nbdkit-nbd-plugin
nbdkit-linuxdisk-plugin
nbdkit-gzip-plugin
nbdkit-gzip-filter
nbdkit-example-plugins
nbdkit-devel
nbdkit-curl-plugin
nbdkit-basic-filters
nbdkit
nbdkit-bash-completion
nbdkit-tar-plugin
nbdkit-tmpdisk-plugin
nbdkit-vddk-plugin
nbdkit-xz-filter
virt-v2v
virt-v2v-bash-completion
virt-v2v-man-pages-ja
virt-v2v-man-pages-uk
python3-libguestfs
libguestfs-man-pages-uk
libguestfs-man-pages-ja
libguestfs-tools
libguestfs-rsync
libguestfs-javadoc
libguestfs-inspect-icons
libguestfs-bash-completion
virt-dib
libguestfs-xfs
ruby-libguestfs
ocaml-libguestfs-devel
lua-guestfs
libguestfs-java
libguestfs-gobject-devel
libguestfs-gobject
libguestfs-gfs2
libguestfs-devel
libguestfs-appliance
ocaml-libguestfs
libguestfs
libguestfs-java-devel
perl-Sys-Guestfs
libguestfs-tools-c
libguestfs-rescue
supermin-devel
supermin
qemu-guest-agent
qemu-kvm-ui-spice
qemu-img
qemu-kvm
qemu-kvm-block-curl
qemu-kvm-block-gluster
qemu-kvm-block-iscsi
qemu-kvm-block-rbd
qemu-kvm-block-ssh
qemu-user-static
qemu-kvm-core
qemu-kvm-docs
qemu-kvm-hw-usbredir
qemu-kvm-tests
qemu-kvm-ui-opengl
qemu-kvm-common
perl-Sys-Virt
python3-libvirt
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-daemon-driver-secret
libvirt-daemon-driver-qemu
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-network
libvirt-daemon-driver-interface
libvirt-daemon-config-nwfilter
libvirt-daemon-config-network
libvirt-daemon
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-scsi
libvirt-daemon-kvm
libvirt-devel
libvirt-docs
libvirt-libs
libvirt-lock-sanlock
libvirt-nss
libvirt-wireshark
libvirt
libvirt-client
libguestfs-winsupport
PowerVM Hypervisor
Red Hat OpenShift Container Platform

Install updates from vendor's website.

libtpms - addressed in versions 0.7.12, 0.8.10, 0.9.7, 0.10.1
PowerVM Hypervisor - update to FW1050.41
netcf - update to 0.2.8-12.0.1
netcf-libs - update to 0.2.8-12.0.1
netcf-devel - update to 0.2.8-12.0.1
swtpm-tools-pkcs11 - update to 0.7.0-4.20211109gitb79fd91
swtpm - update to 0.7.0-4.20211109gitb79fd91
swtpm-devel - update to 0.7.0-4.20211109gitb79fd91
swtpm-libs - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools - update to 0.7.0-4.20211109gitb79fd91
libtpms - addressed in versions 0.7.3-9, 0.7.3-10, 0.9.5-5
libtpms-debuginfo - addressed in versions 0.7.3-9, 0.7.3-10, 0.9.5-5
libtpms-debugsource - addressed in versions 0.7.3-9, 0.7.3-10, 0.9.5-5
libtpms-devel - addressed in versions 0.7.3-9, 0.7.3-10, 0.9.5-5
libtpms-devel - update to 0.9.1-3.20211126git1ff6fe1f43
libtpms - update to 0.9.1-3.20211126git1ff6fe1f43
libtpms (Red Hat package) - addressed in versions 0.9.1-5.20211126git1ff6fe1f43.el9_2, 0.9.1-5.20211126git1ff6fe1f43.el9_4, 0.9.1-5.20211126git1ff6fe1f43.el9_6, 0.9.6-11.el10_0
libtpms (Ubuntu package) - addressed in versions 0.9.3-0ubuntu1.22.04.2, 0.9.3-0ubuntu4.24.04.1, 0.9.3-0ubuntu4.24.10.1, 0.9.3-0ubuntu4.25.04.1
libtpms-debugsource - update to 0.9.6-150600.3.3.1
libtpms-devel - update to 0.9.6-150600.3.3.1
libtpms0-debuginfo - update to 0.9.6-150600.3.3.1
libtpms0 - update to 0.9.6-150600.3.3.1
libtpms - addressed in versions 0.9.7-1.fc41, 0.10.1-1.fc42
sgabios-bin - update to 0.20170427git-3
sgabios - update to 0.20170427git-3
libvirt-dbus - update to 1.3.0-2
ruby-hivex - update to 1.3.18-23
python3-hivex - update to 1.3.18-23
perl-hivex - update to 1.3.18-23
hivex - update to 1.3.18-23
hivex-devel - update to 1.3.18-23
ocaml-hivex-devel - update to 1.3.18-23
ocaml-hivex - update to 1.3.18-23
python3-libnbd - update to 1.6.0-6.0.1
nbdfuse - update to 1.6.0-6.0.1
libnbd-devel - update to 1.6.0-6.0.1
libnbd - update to 1.6.0-6.0.1
ocaml-libnbd - update to 1.6.0-6.0.1
ocaml-libnbd-devel - update to 1.6.0-6.0.1
libnbd-bash-completion - update to 1.6.0-6.0.1
seavgabios-bin - update to 1.16.0-4
seabios-bin - update to 1.16.0-4
seabios - update to 1.16.0-4
libiscsi-utils - update to 1.18.0-8.0.2
libiscsi-devel - update to 1.18.0-8.0.2
libiscsi - update to 1.18.0-8.0.2
nbdkit-basic-plugins - update to 1.24.0-5
nbdkit-tar-filter - update to 1.24.0-5
nbdkit-ssh-plugin - update to 1.24.0-5
nbdkit-server - update to 1.24.0-5
nbdkit-python-plugin - update to 1.24.0-5
nbdkit-nbd-plugin - update to 1.24.0-5
nbdkit-linuxdisk-plugin - update to 1.24.0-5
nbdkit-gzip-plugin - update to 1.24.0-5
nbdkit-gzip-filter - update to 1.24.0-5
nbdkit-example-plugins - update to 1.24.0-5
nbdkit-devel - update to 1.24.0-5
nbdkit-curl-plugin - update to 1.24.0-5
nbdkit-basic-filters - update to 1.24.0-5
nbdkit - update to 1.24.0-5
nbdkit-bash-completion - update to 1.24.0-5
nbdkit-tar-plugin - update to 1.24.0-5
nbdkit-tmpdisk-plugin - update to 1.24.0-5
nbdkit-vddk-plugin - update to 1.24.0-5
nbdkit-xz-filter - update to 1.24.0-5
virt-v2v - update to 1.42.0-22
virt-v2v-bash-completion - update to 1.42.0-22
virt-v2v-man-pages-ja - update to 1.42.0-22
virt-v2v-man-pages-uk - update to 1.42.0-22
python3-libguestfs - update to 1.44.0-9.0.1
libguestfs-man-pages-uk - update to 1.44.0-9.0.1
libguestfs-man-pages-ja - update to 1.44.0-9.0.1
libguestfs-tools - update to 1.44.0-9.0.1
libguestfs-rsync - update to 1.44.0-9.0.1
libguestfs-javadoc - update to 1.44.0-9.0.1
libguestfs-inspect-icons - update to 1.44.0-9.0.1
libguestfs-bash-completion - update to 1.44.0-9.0.1
virt-dib - update to 1.44.0-9.0.1
libguestfs-xfs - update to 1.44.0-9.0.1
ruby-libguestfs - update to 1.44.0-9.0.1
ocaml-libguestfs-devel - update to 1.44.0-9.0.1
lua-guestfs - update to 1.44.0-9.0.1
libguestfs-java - update to 1.44.0-9.0.1
libguestfs-gobject-devel - update to 1.44.0-9.0.1
libguestfs-gobject - update to 1.44.0-9.0.1
libguestfs-gfs2 - update to 1.44.0-9.0.1
libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-appliance - update to 1.44.0-9.0.1
ocaml-libguestfs - update to 1.44.0-9.0.1
libguestfs - update to 1.44.0-9.0.1
libguestfs-java-devel - update to 1.44.0-9.0.1
perl-Sys-Guestfs - update to 1.44.0-9.0.1
libguestfs-tools-c - update to 1.44.0-9.0.1
libguestfs-rescue - update to 1.44.0-9.0.1
Red Hat OpenShift Container Platform - addressed in versions 4.15.56, 4.16.46, 4.17.37, 4.18.22, 4.19.7
supermin-devel - update to 5.2.1-2.0.2
supermin - update to 5.2.1-2.0.2
qemu-guest-agent - update to 6.2.0-53.0.8
qemu-kvm-ui-spice - update to 6.2.0-53.0.8
qemu-img - update to 6.2.0-53.0.8
qemu-kvm - update to 6.2.0-53.0.8
qemu-kvm-block-curl - update to 6.2.0-53.0.8
qemu-kvm-block-gluster - update to 6.2.0-53.0.8
qemu-kvm-block-iscsi - update to 6.2.0-53.0.8
qemu-kvm-block-rbd - update to 6.2.0-53.0.8
qemu-kvm-block-ssh - update to 6.2.0-53.0.8
qemu-user-static - update to 6.2.0-53.0.8
qemu-kvm-core - update to 6.2.0-53.0.8
qemu-kvm-docs - update to 6.2.0-53.0.8
qemu-kvm-hw-usbredir - update to 6.2.0-53.0.8
qemu-kvm-tests - update to 6.2.0-53.0.8
qemu-kvm-ui-opengl - update to 6.2.0-53.0.8
qemu-kvm-common - update to 6.2.0-53.0.8
perl-Sys-Virt - update to 8.0.0-1
python3-libvirt - update to 8.0.0-2
libvirt-daemon-driver-storage-iscsi - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-gluster - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-disk - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-core - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-secret - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-qemu - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-nwfilter - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-nodedev - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-network - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-interface - update to 8.0.0-23.4.0.1
libvirt-daemon-config-nwfilter - update to 8.0.0-23.4.0.1
libvirt-daemon-config-network - update to 8.0.0-23.4.0.1
libvirt-daemon - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-iscsi-direct - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-logical - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-mpath - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-rbd - update to 8.0.0-23.4.0.1
libvirt-daemon-driver-storage-scsi - update to 8.0.0-23.4.0.1
libvirt-daemon-kvm - update to 8.0.0-23.4.0.1
libvirt-devel - update to 8.0.0-23.4.0.1
libvirt-docs - update to 8.0.0-23.4.0.1
libvirt-libs - update to 8.0.0-23.4.0.1
libvirt-lock-sanlock - update to 8.0.0-23.4.0.1
libvirt-nss - update to 8.0.0-23.4.0.1
libvirt-wireshark - update to 8.0.0-23.4.0.1
libvirt - update to 8.0.0-23.4.0.1
libvirt-client - update to 8.0.0-23.4.0.1
libguestfs-winsupport - update to 8.10-1

• https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1
• https://github.com/stefanberger/libtpms/security/advisories/GHSA-25w5-6fjj-hf8g
• https://trustedcomputinggroup.org/wp-content/uploads/TPM-2.0-1.83-Part-4-Supporting-Routines-Code.pdf

• Local denial of service in Libtpms
• Fedora 42 update for libtpms
• Fedora 41 update for libtpms
• openEuler 22.03 LTS SP4 update for libtpms
• openEuler 20.03 LTS SP4 update for libtpms
• Red Hat Enterprise Linux 9 update for libtpms
• Red Hat Enterprise Linux 9 update for libtpms
• Red Hat Enterprise Linux 9 update for libtpms
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel module
• Ubuntu update for libtpms
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Anolis OS update for virt:an8 module
• openEuler 24.03 LTS SP2 update for libtpms
• openEuler 24.03 LTS SP1 update for libtpms
• openEuler 22.03 LTS SP3 update for libtpms
• openEuler 24.03 LTS update for libtpms
• Red Hat Enterprise Linux 10 update for libtpms
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel module
• Multiple vulnerabilities in IBM PowerVM Hypervisor
• SUSE update for libtpms