CVE-2021-3623: Medium severity red hat libtpms vulnerability
A bug was discovered in the libtpms code that may cause access to a buffer beyond the boundary of the buffer or cause failures when trying to resume the state of the vTPM. The vulnerability can be triggered by specially-crafted TPM 2 command packets containing unacceptable/illegal values and those values become an issue when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. In the former case this can lead to a buffer access beyond its boundary and in the latter case to refusal to accept the state blob due to an illegal value.
To the best of our knowledge, the buffer access beyond its boundaries case does NOT lead to code execution, and as such, any exploitation is likely limited to information leakage and / or denial-of-service (DoS), i.e. a crash. Further, an attacker must have (indirect or direct) access to call TPMLIBVolatileAllStore to exploit this flaw.
Upstream PR: https://github.com/stefanberger/libtpms/pull/223
Upstream fix: https://github.com/stefanberger/libtpms/commit/2f30d62 https://github.com/stefanberger/libtpms/commit/7981d9a https://github.com/stefanberger/libtpms/commit/2e6173c
Other sources
A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID is CVE-2021-3623.
What is the severity of CVE-2021-3623?
The severity of CVE-2021-3623 is medium (6.1).
How can the flaw in libtpms be triggered?
The flaw in libtpms can be triggered by specially-crafted TPM 2 command packets containing illegal values.
What is the highest threat from this vulnerability?
The highest threat from this vulnerability is to system integrity.
Where can I find more information about CVE-2021-3623?
You can find more information about CVE-2021-3623 on the Red Hat Bugzilla page: https://bugzilla.redhat.com/show_bug.cgi?id=1976806 and on the GitHub commits: https://github.com/stefanberger/libtpms/commit/2e6173c and https://github.com/stefanberger/libtpms/commit/2f30d62.