1338 matches found
[SECURITY] Fedora 38 Update: libtpms-0.9.6-1.fc38
A library providing TPM functionality for VMs. Targeted for integration into Qemu...
Fedora: Security Advisory for libtpms (FEDORA-2023-64f2a84db1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Actors, Threats and Vulnerabilities 6 March to 12 March 2023
For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here Last week, HiveForce Labs discovered three threat actors. One of them is a Russian group called TA499, which has a history of conducting different cyberattacks such as...
SUSE CVE-2023-1017
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service crashing the TPM chip/process ...
EulerOS 2.0 SP5 : kernel (EulerOS-SA-2023-1507)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock in the Linux kernels filesystem sub-component. This flaw allows a local attacker...
Use-After-Free
linux is vulnerable to use-after-free. The vulnerability exists on the systems where virtualized TPM devices are configured, a local attacker is able to create a use-after-free and create a situation where it may be possible to escalate privileges on the system...
Two New Vulnerabilities Discovered in TPM 2.0 Library
Threat Level Vulnerability Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary The Trusted Platform Module TPM 2.0 specification, a hardware-based technology used to provide tamper-resistant secure cryptographic functions, is affected by...
SUSE SLES15: libtss2-esys0 / libtss2-fapi0 / libtss2-mu0 / libtss2-rc0 / etc (SUSE-SU-2023:0613-1)
The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0613-1 advisory. - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access bsc1207325. Tenable has extracted...
K000132856: TPM 2.0 vulnerabilities CVE-2023-1017 and CVE-2023-1018
Security Advisory Description Two buffer overflow vulnerabilities were discovered in the Trusted Platform Module TPM 2.0 reference library specification, currently at Level 00, Revision 01.59 November 2019. An attacker who has access to a TPM-command interface can send maliciously-crafted command...
SUSE-SU-2023:0613-1 Security update for tpm2-0-tss
This update for tpm2-0-tss fixes the following issues: - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access bsc1207325...
New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices
A pair of serious security defects has been disclosed in the Trusted Platform Module TPM 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation. One of the vulnerabilities, CVE-2023-1017 , concerns an out-of-bounds write, while the other,...
Man-in-the-Middle Attack (MITM)
github.com/edgelesssys/constellation is vulnerable to Man-in-the-Middle Attacks MITM. The vulnerability exists because attestation user data, including the digest of a public key in a aTLS connection are incorrectly bound to the issuers TPM, not the PCR state. If an attacker can intercept a node...
CVE-2023-1017
An out-of-bounds write vulnerability was found in the TPM 2.0's Module Library, which allows the writing of 2-byte data after the end of the TPM command. This flaw may lead to a denial of service or arbitrary code execution within the libtpms scope...
Nuvoton TPM Denial of Service Vulnerability - Lenovo Support US
No description provided...
CVE-2023-1018
An out-of-bound read vulnerability was found in the TPM 2.0's Module Library, which allows the reading of 2-byte data after the end of the TPM command. This flaw allows an attacker to leak confidential data stored within the libtpms context...
TPM 2.0 Vulnerabilities - Lenovo Support US
No description provided...
TCG TPM2.0 implementations vulnerable to memory corruption
Overview Two buffer overflow vulnerabilities were discovered in the Trusted Platform Module TPM 2.0 reference library specification, currently at Level 00, Revision 01.59 November 2019. An attacker who has access to a TPM-command interface can send maliciously-crafted commands to the module and...
SUSE-SU-2023:0526-1 Security update for tpm2-0-tss
This update for tpm2-0-tss fixes the following issues: - CVE-2023-22745: Fixed a memory safety issue that could be exploited by local attackers with TPM access bsc1207325...
K91171450: BIG-IP engineering hotfix Trusted Platform Module vulnerability CVE-2020-5851
Security Advisory Description On impacted versions and platforms, the Trusted Platform Module TPM system integrity check cannot detect modifications to specific system components. CVE-2020-5851 Impact BIG-IP The Trusted Platform Module TPM on the BIG-IP iSeries platforms i850, i2000, i4000, i5000...
GHSA-R2H5-3HGW-8J34 User data in TPM attestation vulnerable to MITM
Impact Attestation user data such as the digest of the public key in an aTLS connection was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In...