A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtpms-0.9.1-2.20211126git1ff6fe1f43.el9 build changelog.

  - out-of-bounds access when trying to resume the state of the vTPM (CVE-2021-3623)

  - out-of-bounds access via specially crafted TPM 2 command packets (CVE-2021-3746)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libtpms-0.8.2-0.20210301git729fc6a4ca.el9.6 build changelog.

  - out-of-bounds access when trying to resume the state of the vTPM (CVE-2021-3623)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4457-1 advisory.

  - A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets     containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is     marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system     availability. (CVE-2021-3623)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9240 advisory.

    libtpms     [0.8.8-1.el7]
    - spec: Update spec file to version 0.8.8

    * Fri Sep 17 2021 Stefan Berger - 0.8.7-1
    - tpm2: Fixes for building and running with OpenSSL 3.0

    * Fri Sep 10 2021 Stefan Berger - 0.8.6-1
    - tpm2: Marshal event sequence objects' hash state

    * Wed Sep 01 2021 Stefan Berger - 0.8.5-1
    - tpm2: NVMarshal: Handle index orderly RAM without 0-sized terminating node
    - tpm2: Initialize a whole OBJECT before using it

    * Wed Jun 23 2021 Stefan Berger - 0.8.4-1
    - tpm2: Reset too large size indicators in TPM2B to avoid access beyond buffer

    * Tue Jun 01 2021 Stefan Berger - 0.8.3-1
    - tpm2: Work-around for Windows 2016 & 2019 bug related to ContextLoad

    swtpm     [0.3.4-5.el7]
    - swtpm: Check header size indicator against expected size (CID 375869) (Stefan       Berger)  [Orabug: 33876933]  {CVE-2022-23645}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191313	CentOS 9 : libtpms-0.9.1-2.20211126git1ff6fe1f43.el9	Nessus	CentOS Local Security Checks	medium
191284	CentOS 9 : libtpms-0.8.2-0.20210301git729fc6a4ca.el9.6	Nessus	CentOS Local Security Checks	medium
168718	SUSE SLES15 Security Update : libtpms (SUSE-SU-2022:4457-1)	Nessus	SuSE Local Security Checks	medium
159123	Oracle Linux 7 : libtpms (ELSA-2022-9240)	Nessus	Oracle Linux Local Security Checks	medium

Detections

Analytics

CVE-2021-3623

medium

Tenable Plugins

medium

medium

medium

medium