An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.
References
| Link | Resource |
|---|---|
| https://kb.cert.org/vuls/id/782720 | Third Party Advisory US Government Resource |
| https://trustedcomputinggroup.org/about/security/ | Vendor Advisory |
| https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
01 Apr 2024, 15:50
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* |
|
| First Time |
Microsoft windows 10 22h2
Microsoft windows 10 20h2 Microsoft windows Server 2019 Microsoft windows 10 1809 Microsoft Microsoft windows 10 1607 Microsoft windows 11 22h2 Microsoft windows Server 2022 Microsoft windows Server 2016 Microsoft windows 10 21h2 Microsoft windows 11 21h2 Microsoft windows 10 1507 |
10 Mar 2023, 02:04
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 | |
| First Time |
Trustedcomputinggroup
Trustedcomputinggroup trusted Platform Module |
|
| References | (MISC) https://kb.cert.org/vuls/id/782720 - Third Party Advisory, US Government Resource | |
| References | (MISC) https://trustedcomputinggroup.org/about/security/ - Vendor Advisory | |
| References | (MISC) https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CPE | cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.38:*:*:*:*:*:* cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.16:*:*:*:*:*:* cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.59:*:*:*:*:*:* |
28 Feb 2023, 20:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-02-28 19:15
Updated : 2024-04-01 15:50
NVD link : CVE-2023-1017
Mitre link : CVE-2023-1017
CVE.ORG link : CVE-2023-1017
JSON object : View
Products Affected
microsoft
- windows_server_2016
- windows_10_21h2
- windows_server_2019
- windows_server_2022
- windows_10_20h2
- windows_10_1809
- windows_11_21h2
- windows_10_22h2
- windows_11_22h2
- windows_10_1607
- windows_10_1507
trustedcomputinggroup
- trusted_platform_module
CWE
CWE-787
Out-of-bounds Write