Buffer overflow in tpm2-tss - CVE-2023-22745

Vulnerability identifier: #VU71458

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22745

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in "Tss2_RC_SetHandler" and "Tss2_RC_Decode". A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

tpm2-tss
IBM Cloud Pak for Watson AIOps
IBM Sterling Order Management
Robotic Process Automation for Cloud Pak
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Migration Toolkit for Runtimes
OpenShift Pipelines
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Multicluster GlobalHub
Netcool Operations Insight
Cryostat
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat OpenShift Dev Spaces
Red Hat Migration Toolkit for Applications
IBM Power Hardware Management Console (HMC)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Service Mesh
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libtss2-esys0 (Ubuntu package)
tpm2-tss (Red Hat package)
tpm2-tss-doc
tpm2-tss-devel
tpm2-tss
libtss2-tctildr0-debuginfo
libtss2-esys0
libtss2-tctildr0
libtss2-esys0-debuginfo
libtss2-rc0
libtss2-mu0-debuginfo
libtss2-tcti-mssim0-debuginfo
libtss2-tcti-mssim0
tpm2-0-tss-debugsource
libtss2-mu0
libtss2-tcti-device0-debuginfo
libtss2-fapi0-debuginfo
libtss2-fapi0
libtss2-sys0-debuginfo
libtss2-sys0
libtss2-sys0-32bit-debuginfo
libtss2-sys0-32bit
tpm2-0-tss-devel
libtss2-tcti-device0
tpm2-0-tss
libtss2-rc0-debuginfo
tpm2-tss-debuginfo
tpm2-tss-help
tpm2-tss-debugsource
libtss2-fapi1-debuginfo
libtss2-sys1
libtss2-tcti-swtpm0
libtss2-fapi1-32bit-debuginfo
libtss2-tcti-device0-32bit
libtss2-rc0-32bit-debuginfo
libtss2-tcti-mssim0-32bit-debuginfo
libtss2-tcti-swtpm0-debuginfo
libtss2-tctildr0-32bit-debuginfo
libtss2-tcti-cmd0
libtss2-tcti-cmd0-debuginfo
libtss2-tcti-pcap0-debuginfo
libtss2-tcti-pcap0
libtss2-fapi1
libtss2-tctildr0-32bit
libtss2-rc0-32bit
libtss2-sys1-debuginfo
libtss2-tcti-cmd0-32bit-debuginfo
libtss2-tcti-device0-32bit-debuginfo
libtss2-sys1-32bit
libtss2-tcti-swtpm0-32bit
libtss2-fapi1-32bit
libtss2-mu0-32bit-debuginfo
libtss2-mu0-32bit
libtss2-sys1-32bit-debuginfo
libtss2-tcti-cmd0-32bit
libtss2-tcti-mssim0-32bit
libtss2-tcti-swtpm0-32bit-debuginfo
libtss2-esys0-32bit-debuginfo
libtss2-esys0-32bit
libtss2-rc0 (Ubuntu package)
libtss2-sys1 (Ubuntu package)
libtss2-esys-3.0.2-0 (Ubuntu package)
libtss2-tcti-cmd0 (Ubuntu package)
libtss2-tcti-device0 (Ubuntu package)
libtss2-fapi1 (Ubuntu package)
libtss2-tcti-mssim0 (Ubuntu package)
libtss2-mu0 (Ubuntu package)
libtss2-tcti-swtpm0 (Ubuntu package)
libtss2-tctildr0 (Ubuntu package)
tpm2-tools-5.4-1.fc36 tpm2-tss
libtss2-policy0 (Ubuntu package)
libtss2-tcti-libtpms0 (Ubuntu package)
libtss2-tcti-pcap0 (Ubuntu package)
libtss2-tcti-spi-helper0 (Ubuntu package)
libtss2-fapi1t64 (Ubuntu package)
libtss2-tcti-swtpm0t64 (Ubuntu package)
libtss2-esys-3.0.2-0t64 (Ubuntu package)
libtss2-mu-4.0.1-0t64 (Ubuntu package)
libtss2-policy0t64 (Ubuntu package)
libtss2-rc0t64 (Ubuntu package)
libtss2-sys1t64 (Ubuntu package)
libtss2-tcti-cmd0t64 (Ubuntu package)
libtss2-tcti-device0t64 (Ubuntu package)
libtss2-tcti-libtpms0t64 (Ubuntu package)
libtss2-tcti-mssim0t64 (Ubuntu package)
libtss2-tcti-pcap0t64 (Ubuntu package)
libtss2-tcti-spi-helper0t64 (Ubuntu package)
libtss2-tctildr0t64 (Ubuntu package)

Install updates from vendor's website.

tpm2-tss - addressed in versions 3.2.2 rc1, 4.0.1
Migration Toolkit for Runtimes - update to 1.2.4
Migration Toolkit for Containers - addressed in versions 1.7.15, 1.8.3
OpenShift Pipelines - update to 1.10.6
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 3.74.8, 4.1.6, 4.3.1
OpenShift Virtualization - addressed in versions 4.12.9, 4.13.6, 4.14.1
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.12.10
OpenShift Logging - addressed in versions 5.7.10, 5.8.1
Multicluster GlobalHub - update to 1.2.1
Netcool Operations Insight - update to 1.6.12
libtss2-esys0 (Ubuntu package) - update to 2.3.2-1ubuntu0.20.04.2
tpm2-tss (Red Hat package) - addressed in versions 2.3.2-5.el8, 2.3.2-5.el8_6, 2.3.2-5.el8_8, 3.2.2-2.el9
tpm2-tss-doc - update to 2.3.2-5.0.2
tpm2-tss-devel - update to 2.3.2-5.0.2
tpm2-tss - update to 2.3.2-5.0.2
Cryostat - update to 2.4.0
libtss2-tctildr0-debuginfo - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-esys0 - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-tctildr0 - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-esys0-debuginfo - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-rc0 - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-mu0-debuginfo - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-tcti-mssim0-debuginfo - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-tcti-mssim0 - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
tpm2-0-tss-debugsource - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-mu0 - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-tcti-device0-debuginfo - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-fapi0-debuginfo - update to 2.4.5-150300.3.6.1
libtss2-fapi0 - update to 2.4.5-150300.3.6.1
libtss2-sys0-debuginfo - update to 2.4.5-150300.3.6.1
libtss2-sys0 - update to 2.4.5-150300.3.6.1
libtss2-sys0-32bit-debuginfo - update to 2.4.5-150300.3.6.1
libtss2-sys0-32bit - update to 2.4.5-150300.3.6.1
tpm2-0-tss-devel - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-tcti-device0 - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
tpm2-0-tss - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
libtss2-rc0-debuginfo - addressed in versions 2.4.5-150300.3.6.1, 3.1.0-150400.3.3.1
OpenShift Service Mesh - update to 2.5.2
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.10.5, 2.12.0
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.0.0
tpm2-tss-debuginfo - update to 3.0.3-2
tpm2-tss-help - update to 3.0.3-2
tpm2-tss-devel - update to 3.0.3-2
tpm2-tss-debugsource - update to 3.0.3-2
tpm2-tss - update to 3.0.3-2
tpm2-tss - update to 3.1.0-1
libtss2-fapi1-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-sys1 - update to 3.1.0-150400.3.3.1
libtss2-tcti-swtpm0 - update to 3.1.0-150400.3.3.1
libtss2-fapi1-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-device0-32bit - update to 3.1.0-150400.3.3.1
libtss2-rc0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-mssim0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-swtpm0-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tctildr0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-cmd0 - update to 3.1.0-150400.3.3.1
libtss2-tcti-cmd0-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-pcap0-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-pcap0 - update to 3.1.0-150400.3.3.1
libtss2-fapi1 - update to 3.1.0-150400.3.3.1
libtss2-tctildr0-32bit - update to 3.1.0-150400.3.3.1
libtss2-rc0-32bit - update to 3.1.0-150400.3.3.1
libtss2-sys1-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-cmd0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-device0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-sys1-32bit - update to 3.1.0-150400.3.3.1
libtss2-tcti-swtpm0-32bit - update to 3.1.0-150400.3.3.1
libtss2-fapi1-32bit - update to 3.1.0-150400.3.3.1
libtss2-mu0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-mu0-32bit - update to 3.1.0-150400.3.3.1
libtss2-sys1-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-tcti-cmd0-32bit - update to 3.1.0-150400.3.3.1
libtss2-tcti-mssim0-32bit - update to 3.1.0-150400.3.3.1
libtss2-tcti-swtpm0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-esys0-32bit-debuginfo - update to 3.1.0-150400.3.3.1
libtss2-esys0-32bit - update to 3.1.0-150400.3.3.1
libtss2-rc0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-sys1 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-esys-3.0.2-0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-tcti-cmd0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-tcti-device0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-fapi1 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-tcti-mssim0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-mu0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-tcti-swtpm0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
libtss2-tctildr0 (Ubuntu package) - addressed in versions 3.2.0-1ubuntu1.1, 4.0.1-3ubuntu1.1
tpm2-tools-5.4-1.fc36 tpm2-tss - update to 3.2.2-1.fc36
tpm2-tss - update to 3.2.2-1.fc37
Red Hat OpenShift Dev Spaces - update to 3.16.0
libtss2-policy0 (Ubuntu package) - update to 4.0.1-3ubuntu1.1
libtss2-tcti-libtpms0 (Ubuntu package) - update to 4.0.1-3ubuntu1.1
libtss2-tcti-pcap0 (Ubuntu package) - update to 4.0.1-3ubuntu1.1
libtss2-tcti-spi-helper0 (Ubuntu package) - update to 4.0.1-3ubuntu1.1
libtss2-fapi1t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tcti-swtpm0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-esys-3.0.2-0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-mu-4.0.1-0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-policy0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-rc0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-sys1t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tcti-cmd0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tcti-device0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tcti-libtpms0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tcti-mssim0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tcti-pcap0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tcti-spi-helper0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
libtss2-tctildr0t64 (Ubuntu package) - update to 4.0.1-7.1ubuntu5.1
IBM Cloud Pak for Watson AIOps - update to 4.4.1
Red Hat OpenShift Container Platform - addressed in versions 4.12.61, 4.16.15, 4.16.44, 4.17.0
Red Hat Migration Toolkit for Applications - update to 6.2
IBM Sterling Order Management - update to 10.0.2403.1
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP2, 10.3.1060.0
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.13, 23.0.13

• https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5
• https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67

• Remote code execution in tpm2-tss
• SUSE update for tpm2-0-tss
• SUSE update for tpm2-0-tss
• Fedora 37 update for tpm2-tss
• Fedora 36 update for tpm2-tools-5.4-1.fc36 tpm2-tss
• Red Hat Enterprise Linux 9 update for tpm2-tss
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for tpm2-tss
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Multiple vulnerabilities in Red Hat Openshift distributed tracing
• Multiple vulnerabilities in Red Hat OpenShift Pipelines 1.10
• Multiple vulnerabilities in Red Hat build of Cryostat
• Multiple vulnerabilities in OpenShift Virtualization 4.14
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.3
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in Logging Subsystem 5.8 for Red Hat OpenShift
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Logging Subsystem 5.7 for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 3.74
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.1
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• openEuler update for tpm2-tss
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Sterling Order Management
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Ubuntu update for tpm2-tss
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Red Hat Enterprise Linux 8 update for tpm2-tss
• Red Hat Enterprise Linux 8 update for tpm2-tss
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Amazon Linux AMI update for tpm2-tss
• Buffer overflow in IBM Power HMC
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.10
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Multicluster GlobalHub 1.2
• Anolis OS update for tpm2-tss
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16