CVE-2021-3746: Buffer Overflow
A bug was discovered in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability can be triggered by specially-crafted TPM 2 command packets that then trigger the issue when the state of the TPM 2's volatile state is marshalled/written.
Reference and upstream patches: https://github.com/stefanberger/libtpms/commit/1fb6cd9b8df05b5d6e381b31215193d6ada969df https://github.com/stefanberger/libtpms/commit/ea62fd9679f8c6fc5e79471b33cfbd8227bfed72
Other sources
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3746?
CVE-2021-3746 is a vulnerability in the libtpms code that allows access beyond the boundary of internal buffers.
How is the CVE-2021-3746 vulnerability triggered?
The vulnerability is triggered by specially-crafted TPM2 command packets that write to the TPM2's volatile state.
What is the severity of CVE-2021-3746?
CVE-2021-3746 has a severity rating of 6.5 (high).
Which software is affected by CVE-2021-3746?
The Libtpms Project versions 0.6.0 to 0.6.6, 0.7.0 to 0.7.9, and 0.8.0 to 0.8.5, as well as Fedora 34 and Red Hat Enterprise Linux 8.0 and Advanced Virtualization are affected.
How can I fix CVE-2021-3746?
To fix CVE-2021-3746, update the libtpms code to a version that includes the necessary security patches.