Out-of-bounds read in Trusted Platform Module (TPM) 2.0 - CVE-2023-1018

Vulnerability identifier: #VU72707

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-1018

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the CryptParameterDecryption routine. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system.

Trusted Platform Module (TPM) 2.0
Oracle Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Microsoft Windows
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Fedora
Windows Server
2nd Gen AMD Ryzen Threadripper processors
IBM Power System AC922
libtpms
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
netcf-devel
netcf
netcf-libs
swtpm-devel
swtpm-tools-pkcs11
swtpm-tools
swtpm-libs
swtpm
libtpms
libtpms-devel
libtpms-debuginfo
libtpms-debugsource
libtpms0-debuginfo
libtpms0
libtpms (Red Hat package)
libtpms0 (Ubuntu package)
sgabios
sgabios-bin
libvirt-dbus
hivex-devel
ocaml-hivex
hivex
ruby-hivex
ocaml-hivex-devel
python3-hivex
perl-hivex
ocaml-libnbd
ocaml-libnbd-devel
nbdfuse
libnbd
python3-libnbd
libnbd-devel
libnbd-bash-completion
seabios
seavgabios-bin
seabios-bin
libiscsi-utils
libiscsi-devel
libiscsi
nbdkit-gzip-plugin
nbdkit-basic-filters
nbdkit-gzip-filter
nbdkit-example-plugins
nbdkit-devel
nbdkit-curl-plugin
nbdkit-basic-plugins
nbdkit
nbdkit-linuxdisk-plugin
nbdkit-nbd-plugin
nbdkit-python-plugin
nbdkit-server
nbdkit-ssh-plugin
nbdkit-tar-filter
nbdkit-tar-plugin
nbdkit-tmpdisk-plugin
nbdkit-xz-filter
nbdkit-bash-completion
nbdkit-vddk-plugin
virt-v2v-man-pages-uk
virt-v2v-man-pages-ja
virt-v2v-bash-completion
virt-v2v
libguestfs-tools-c
ruby-libguestfs
libguestfs-gobject
virt-dib
libguestfs-gobject-devel
ocaml-libguestfs
ocaml-libguestfs-devel
libguestfs-java
libguestfs-java-devel
perl-Sys-Guestfs
libguestfs-rescue
libguestfs-rsync
libguestfs-xfs
python3-libguestfs
libguestfs-javadoc
lua-guestfs
libguestfs
libguestfs-appliance
libguestfs-tools
libguestfs-man-pages-uk
libguestfs-man-pages-ja
libguestfs-inspect-icons
libguestfs-bash-completion
libguestfs-devel
libguestfs-gfs2
supermin-devel
supermin
qemu-kvm-common
qemu-kvm-block-curl
qemu-kvm-tests
qemu-kvm-docs
qemu-kvm-core
qemu-kvm-block-gluster
qemu-kvm-hw-usbredir
qemu-kvm-ui-opengl
qemu-kvm-ui-spice
qemu-user-static
qemu-kvm-block-rbd
qemu-kvm-block-iscsi
qemu-kvm-block-ssh
qemu-kvm
qemu-img
qemu-guest-agent
perl-Sys-Virt
python3-libvirt
libvirt-daemon-driver-storage-disk
libvirt-wireshark
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-scsi
libvirt-daemon-kvm
libvirt-devel
libvirt-docs
libvirt-libs
libvirt-lock-sanlock
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-daemon-driver-secret
libvirt-daemon-driver-qemu
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-network
libvirt-daemon-driver-interface
libvirt-daemon-config-nwfilter
libvirt-daemon-config-network
libvirt-daemon
libvirt-client
libvirt
libvirt-nss
libguestfs-winsupport
PowerVM Hypervisor
PowerProtect DP Series Appliance (IDPA)
Dell EMC VxRail Appliance

Install updates from vendor's website.

Trusted Platform Module (TPM) 2.0 - addressed in versions 1.16, 1.38, 1.59
libtpms - addressed in versions 0.8.9, 0.9.6
Red Hat OpenShift Container Platform - update to 4.13.2
PowerVM Hypervisor - addressed in versions FW1010.60, FW1020.40
IBM Power System AC922 - update to OP940.70
netcf-devel - update to 0.2.8-12
netcf - update to 0.2.8-12
netcf-libs - update to 0.2.8-12
swtpm-devel - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools-pkcs11 - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools - update to 0.7.0-4.20211109gitb79fd91
swtpm-libs - update to 0.7.0-4.20211109gitb79fd91
swtpm - update to 0.7.0-4.20211109gitb79fd91
libtpms - update to 0.7.3-8
libtpms-devel - update to 0.7.3-8
libtpms-debuginfo - update to 0.7.3-8
libtpms-debugsource - update to 0.7.3-8
libtpms-devel - update to 0.8.2-150300.3.9.1
libtpms0-debuginfo - update to 0.8.2-150300.3.9.1
libtpms-debugsource - update to 0.8.2-150300.3.9.1
libtpms0 - update to 0.8.2-150300.3.9.1
libtpms-devel - update to 0.9.1-2.20211126git1ff6fe1f43
libtpms - update to 0.9.1-2.20211126git1ff6fe1f43
libtpms (Red Hat package) - update to 0.9.1-3.20211126git1ff6fe1f43.el9_2
libtpms0 (Ubuntu package) - addressed in versions 0.9.3-0ubuntu1.22.04.1, 0.9.3-0ubuntu1.22.10.1
libtpms - addressed in versions 0.9.6-1.fc36, 0.9.6-1.fc37, 0.9.6-1.fc38
sgabios - update to 0.20170427git-3
sgabios-bin - update to 0.20170427git-3
libvirt-dbus - update to 1.3.0-2
hivex-devel - update to 1.3.18-23
ocaml-hivex - update to 1.3.18-23
hivex - update to 1.3.18-23
ruby-hivex - update to 1.3.18-23
ocaml-hivex-devel - update to 1.3.18-23
python3-hivex - update to 1.3.18-23
perl-hivex - update to 1.3.18-23
ocaml-libnbd - update to 1.6.0-5.0.1
ocaml-libnbd-devel - update to 1.6.0-5.0.1
nbdfuse - update to 1.6.0-5.0.1
libnbd - update to 1.6.0-5.0.1
python3-libnbd - update to 1.6.0-5.0.1
libnbd-devel - update to 1.6.0-5.0.1
libnbd-bash-completion - update to 1.6.0-5.0.1
seabios - update to 1.16.0-3
seavgabios-bin - update to 1.16.0-3
seabios-bin - update to 1.16.0-3
libiscsi-utils - update to 1.18.0-8.0.1
libiscsi-devel - update to 1.18.0-8.0.1
libiscsi - update to 1.18.0-8.0.1
nbdkit-gzip-plugin - update to 1.24.0-5
nbdkit-basic-filters - update to 1.24.0-5
nbdkit-gzip-filter - update to 1.24.0-5
nbdkit-example-plugins - update to 1.24.0-5
nbdkit-devel - update to 1.24.0-5
nbdkit-curl-plugin - update to 1.24.0-5
nbdkit-basic-plugins - update to 1.24.0-5
nbdkit - update to 1.24.0-5
nbdkit-linuxdisk-plugin - update to 1.24.0-5
nbdkit-nbd-plugin - update to 1.24.0-5
nbdkit-python-plugin - update to 1.24.0-5
nbdkit-server - update to 1.24.0-5
nbdkit-ssh-plugin - update to 1.24.0-5
nbdkit-tar-filter - update to 1.24.0-5
nbdkit-tar-plugin - update to 1.24.0-5
nbdkit-tmpdisk-plugin - update to 1.24.0-5
nbdkit-xz-filter - update to 1.24.0-5
nbdkit-bash-completion - update to 1.24.0-5
nbdkit-vddk-plugin - update to 1.24.0-5
virt-v2v-man-pages-uk - update to 1.42.0-22
virt-v2v-man-pages-ja - update to 1.42.0-22
virt-v2v-bash-completion - update to 1.42.0-22
virt-v2v - update to 1.42.0-22
libguestfs-tools-c - update to 1.44.0-9.0.1
ruby-libguestfs - update to 1.44.0-9.0.1
libguestfs-gobject - update to 1.44.0-9.0.1
virt-dib - update to 1.44.0-9.0.1
libguestfs-gobject-devel - update to 1.44.0-9.0.1
ocaml-libguestfs - update to 1.44.0-9.0.1
ocaml-libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-java - update to 1.44.0-9.0.1
libguestfs-java-devel - update to 1.44.0-9.0.1
perl-Sys-Guestfs - update to 1.44.0-9.0.1
libguestfs-rescue - update to 1.44.0-9.0.1
libguestfs-rsync - update to 1.44.0-9.0.1
libguestfs-xfs - update to 1.44.0-9.0.1
python3-libguestfs - update to 1.44.0-9.0.1
libguestfs-javadoc - update to 1.44.0-9.0.1
lua-guestfs - update to 1.44.0-9.0.1
libguestfs - update to 1.44.0-9.0.1
libguestfs-appliance - update to 1.44.0-9.0.1
libguestfs-tools - update to 1.44.0-9.0.1
libguestfs-man-pages-uk - update to 1.44.0-9.0.1
libguestfs-man-pages-ja - update to 1.44.0-9.0.1
libguestfs-inspect-icons - update to 1.44.0-9.0.1
libguestfs-bash-completion - update to 1.44.0-9.0.1
libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-gfs2 - update to 1.44.0-9.0.1
PowerProtect DP Series Appliance (IDPA) - update to 2.7.7
supermin-devel - update to 5.2.1-2.0.1
supermin - update to 5.2.1-2.0.1
qemu-kvm-common - update to 6.2.0-32.0.1
qemu-kvm-block-curl - update to 6.2.0-32.0.1
qemu-kvm-tests - update to 6.2.0-32.0.1
qemu-kvm-docs - update to 6.2.0-32.0.1
qemu-kvm-core - update to 6.2.0-32.0.1
qemu-kvm-block-gluster - update to 6.2.0-32.0.1
qemu-kvm-hw-usbredir - update to 6.2.0-32.0.1
qemu-kvm-ui-opengl - update to 6.2.0-32.0.1
qemu-kvm-ui-spice - update to 6.2.0-32.0.1
qemu-user-static - update to 6.2.0-32.0.1
qemu-kvm-block-rbd - update to 6.2.0-32.0.1
qemu-kvm-block-iscsi - update to 6.2.0-32.0.1
qemu-kvm-block-ssh - update to 6.2.0-32.0.1
qemu-kvm - update to 6.2.0-32.0.1
qemu-img - update to 6.2.0-32.0.1
qemu-guest-agent - update to 6.2.0-32.0.1
perl-Sys-Virt - update to 8.0.0-1
python3-libvirt - update to 8.0.0-2
libvirt-daemon-driver-storage-disk - update to 8.0.0-20
libvirt-wireshark - update to 8.0.0-20
libvirt-daemon-driver-storage-gluster - update to 8.0.0-20
libvirt-daemon-driver-storage-iscsi - update to 8.0.0-20
libvirt-daemon-driver-storage-iscsi-direct - update to 8.0.0-20
libvirt-daemon-driver-storage-logical - update to 8.0.0-20
libvirt-daemon-driver-storage-mpath - update to 8.0.0-20
libvirt-daemon-driver-storage-rbd - update to 8.0.0-20
libvirt-daemon-driver-storage-scsi - update to 8.0.0-20
libvirt-daemon-kvm - update to 8.0.0-20
libvirt-devel - update to 8.0.0-20
libvirt-docs - update to 8.0.0-20
libvirt-libs - update to 8.0.0-20
libvirt-lock-sanlock - update to 8.0.0-20
libvirt-daemon-driver-storage-core - update to 8.0.0-20
libvirt-daemon-driver-storage - update to 8.0.0-20
libvirt-daemon-driver-secret - update to 8.0.0-20
libvirt-daemon-driver-qemu - update to 8.0.0-20
libvirt-daemon-driver-nwfilter - update to 8.0.0-20
libvirt-daemon-driver-nodedev - update to 8.0.0-20
libvirt-daemon-driver-network - update to 8.0.0-20
libvirt-daemon-driver-interface - update to 8.0.0-20
libvirt-daemon-config-nwfilter - update to 8.0.0-20
libvirt-daemon-config-network - update to 8.0.0-20
libvirt-daemon - update to 8.0.0-20
libvirt-client - update to 8.0.0-20
libvirt - update to 8.0.0-20
libvirt-nss - update to 8.0.0-20
Dell EMC VxRail Appliance - update to 8.0.101
libguestfs-winsupport - update to 8.8-1

• https://kb.cert.org/vuls/id/782720
• https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf
• https://trustedcomputinggroup.org/about/security/
• https://support.lenovo.com/us/en/product_security/LEN-118320
• https://support.lenovo.com/us/en/product_security/LEN-118374

• Multiple vulnerabilities in Trusted Computing Group TPM 2.0
• Multiple vulnerabilities in libtpms
• Ubuntu update for libtpms
• Out-of-bounds read in Microsoft Windows and Windows Server
• Multiple vulnerabilities in 2nd Gen AMD Ryzen Threadripper processors
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the virt:rhel and virt-devel:rhel modules
• SUSE update for libtpms
• Red Hat Enterprise Linux 9 update for libtpms
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in IBM PowerVM Hypervisor
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Fedora 38 update for libtpms
• Fedora 37 update for libtpms
• Fedora 36 update for libtpms
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• openEuler update for libtpms
• Multiple vulnerabilities in IBM Power System AC922
• Multiple vulnerabilities in Dell PowerProtect DP Series Appliance (IDPA)
• Anolis OS update for virt:an module