A flaw was found in swtpm. The SWTPMNVRAMCheckHeader() function in src/swtpm/swtpmnvstore.c validates the caller-supplied buffer length against sizeof(bh), where bh is a blobheader pointer. Because sizeof(bh) evaluates to the pointer size (8 bytes on 64-bit, 4 on 32-bit) rather than the struct size (10 bytes for the packed blobheader), an undersized buffer passes the entry guard. The subsequent access to bh->totlen at offset 6 reads 4 bytes, overreading the allocation by 2 bytes on 64-bit systems (6 bytes on 32-bit). On 64-bit systems with glibc, the overread typically hits allocator padding and the function returns an error without crashing. On 32-bit systems or with non-glibc allocators, daemon termination is possible, causing denial of service to the associated VM. In both cases, the out-of-bounds totlen value is logged, leaking a small amount of adjacent heap data. The control channel attack path requires no encryption keys. The fix is to change sizeof(bh) to sizeof(bh).

A flaw was found in swtpm. The SWTPMNVRAMCheckHeader() function in src/swtpm/swtpmnvstore.c validates the caller-supplied buffer length against sizeof(bh), where bh is a blobheader pointer. Because sizeof(bh) evaluates to the pointer size (8 bytes on 64-bit, 4 on 32-bit) rather than the struct size (10 bytes for the packed blobheader), an undersized buffer passes the entry guard. The subsequent access to bh->totlen at offset 6 reads 4 bytes, overreading the allocation by 2 bytes on 64-bit systems (6 bytes on 32-bit). On 64-bit systems with glibc, the overread typically hits allocator padding and the function returns an error without crashing. On 32-bit systems or with non-glibc allocators, daemon termination is possible, causing denial of service to the associated VM. In both cases, the out-of-bounds totlen value is logged, leaking a small amount of adjacent heap data. The control channel attack path requires no encryption keys. The fix is to change sizeof(bh) to sizeof(bh).