An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.

redhat_unpatched tpm2: tpm2: Unpatched vulnerabilities

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtpms-0.9.1-3.20211126git1ff6fe1f43.el9 build changelog.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2757 advisory.

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through     2021.8.22. (CVE-2022-30786)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G     through 2021.8.22. (CVE-2022-30789)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through     2021.8.22. (CVE-2022-30788)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the     upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.
    (CVE-2021-46790)

  - A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
    (CVE-2022-30784)

  - An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service. (CVE-2022-3165)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2757 advisory.

  - ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the     upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.
    (CVE-2021-46790)

  - A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
    (CVE-2022-30784)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through     2021.8.22. (CVE-2022-30786)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through     2021.8.22. (CVE-2022-30788)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G     through 2021.8.22. (CVE-2022-30789)

  - An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service. (CVE-2022-3165)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2757 advisory.

  - ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the     upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.
    (CVE-2021-46790)

  - A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
    (CVE-2022-30784)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through     2021.8.22. (CVE-2022-30786)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through     2021.8.22. (CVE-2022-30788)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G     through 2021.8.22. (CVE-2022-30789)

  - An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service. (CVE-2022-3165)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2757 advisory.

  - ntfs-3g: heap-based buffer overflow in ntfsck (CVE-2021-46790)

  - QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165)

  - ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value (CVE-2022-30784)

  - ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate     (CVE-2022-30786)

  - ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc (CVE-2022-30788)

  - ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array     (CVE-2022-30789)

  - tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-2453 advisory.

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:2453 advisory.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2453 advisory.

  - tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017)

  - tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2051-1 advisory.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1833 advisory.

  - tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017)

  - tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4afddd37a9 advisory.

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-64f2a84db1 advisory.

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023702. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023697. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023706. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023713. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023696. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023698. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023705. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5933-1 advisory.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c487bde4b4 advisory.

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191244	CentOS 9 : libtpms-0.9.1-3.20211126git1ff6fe1f43.el9	Nessus	CentOS Local Security Checks	high
180965	Oracle Linux 8 : virt:ol / and / virt-devel:rhel (ELSA-2023-2757)	Nessus	Oracle Linux Local Security Checks	high
176122	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2023:2757)	Nessus	Alma Linux Local Security Checks	high
175891	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2023:2757)	Nessus	CentOS Local Security Checks	high
175828	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:2757)	Nessus	Red Hat Local Security Checks	high
175688	Oracle Linux 9 : libtpms (ELSA-2023-2453)	Nessus	Oracle Linux Local Security Checks	high
175648	AlmaLinux 9 : libtpms (ALSA-2023:2453)	Nessus	Alma Linux Local Security Checks	high
175400	RHEL 9 : libtpms (RHSA-2023:2453)	Nessus	Red Hat Local Security Checks	high
174926	SUSE SLES15 / openSUSE 15 Security Update : libtpms (SUSE-SU-2023:2051-1)	Nessus	SuSE Local Security Checks	high
174687	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:1833)	Nessus	Red Hat Local Security Checks	high
172628	Fedora 36 : libtpms (2023-4afddd37a9)	Nessus	Fedora Local Security Checks	high
172596	Fedora 38 : libtpms (2023-64f2a84db1)	Nessus	Fedora Local Security Checks	high
172533	KB5023702: Windows 10 version 1809 / Windows Server 2019 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172532	KB5023697: Windows 10 Version 1607 and Windows Server 2016 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172529	KB5023706: Windows 11 version 22H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172525	KB5023713: Windows 10 LTS 1507 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172521	KB5023696: Windows 10 Version 20H2 / Windows 10 Version 21H2 / Windows 10 Version 22H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172520	KB5023698: Windows 11 version 21H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172518	KB5023705: Windows 2022 / Azure Stack HCI 22H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172243	Ubuntu 22.04 LTS : Libtpms vulnerabilities (USN-5933-1)	Nessus	Ubuntu Local Security Checks	high
172114	Fedora 37 : libtpms (2023-c487bde4b4)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-1018

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

high

high