Bug 2149416 (CVE-2023-1017)

Summary:	CVE-2023-1017 tpm: TCG TPM2.0 implementations vulnerable to memory corruption
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ddepaula, jferlan, kyoshida, marcandre.lureau, rfreire, security-response-team, snikolov, virt-maint, ymankad
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds write vulnerability was found in the TPM 2.0's Module Library, which allows the writing of 2-byte data after the end of the TPM command. This flaw may lead to a denial of service or arbitrary code execution within the libtpms scope.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-04-18 22:06:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2149418, 2149419, 2173960, 2173963, 2173964, 2173966, 2174322, 2178833, 2180754, 2180755, 2185635
Bug Blocks:	2149291

Description Marco Benatto 2022-11-29 20:41:15 UTC

A out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.

Comment 6 Avinash Hanwate 2023-03-01 06:42:39 UTC

Created libtpms tracking bugs for this issue:

Affects: fedora-all [bug 2174322]

Comment 18 errata-xmlrpc 2023-04-18 16:33:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1833 https://access.redhat.com/errata/RHSA-2023:1833

Comment 19 Product Security DevOps Team 2023-04-18 22:06:01 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1017

Comment 20 errata-xmlrpc 2023-05-09 07:49:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2453 https://access.redhat.com/errata/RHSA-2023:2453