Lucene search

[email protected]CVE-2020-24455

HistoryFeb 26, 2021 - 3:15 a.m.

CVE-2020-24455

2021-02-2603:15:12

CWE-909

[email protected]

web.nvd.nist.gov

cve

2020

24455

tpm2

source

privileged

user

escalation

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

14.3%

JSON

Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3.

Affected configurations

NVD

Node

tpm2_software_stack_projecttpm2_software_stackRange<2.4.3

tpm2_software_stack_projecttpm2_software_stackRange3.0.0–3.0.1

Node

fedoraprojectfedoraMatch34

CPENameOperatorVersion
tpm2_software_stack_project:tpm2_software_stacktpm2 software stack project tpm2 software stacklt2.4.3
tpm2_software_stack_project:tpm2_software_stacktpm2 software stack project tpm2 software stacklt3.0.1

CPE	Name	Operator	Version
tpm2_software_stack_project:tpm2_software_stack	tpm2 software stack project tpm2 software stack	lt	2.4.3
tpm2_software_stack_project:tpm2_software_stack	tpm2 software stack project tpm2 software stack	lt	3.0.1

CNA Affected

[
  {
    "product": "TPM2 source",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "before 3.01, before 2.4.3"
      }
    ]
  }
]