CVE-2025-1292: TPM2 Out-Of-Bounds Write Leading to Potential Operating System Verification Bypass in ChromeOS

Published Apr 15, 2025

Updated

Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and bypass operating system verification via exploiting the NVRead functionality during the Challenge-Response process.

Affected Software

3 affected components

Google ChromeOS

All of the following

Google Chrome=122.0.6261.132

Google Chrome OS

Event History

Apr 15, 2025

CVE Published

via MITRE·07:46 PM

Data Sourced

via MITRE·07:46 PM

DescriptionWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-1292?

CVE-2025-1292 is rated as a high severity vulnerability due to its potential to allow attackers with root access to gain persistence.

How do I fix CVE-2025-1292?

To fix CVE-2025-1292, update Google ChromeOS to the latest version that addresses this vulnerability.

What systems are affected by CVE-2025-1292?

CVE-2025-1292 affects Google ChromeOS version 122.0.6261.132 on Cr50 Boards.

What type of attack is possible with CVE-2025-1292?

CVE-2025-1292 allows an attacker to exploit the NV_Read functionality during the Challenge-Response process.

Can CVE-2025-1292 lead to bypassing security measures?

Yes, CVE-2025-1292 can allow attackers to bypass operating system verification.