swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

This plugin was deprecated due to incorrect CVE matches for the build.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the swtpm-0.7.0-2.20211109gitb79fd91.el9 build changelog.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7472 advisory.

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8100 advisory.

    [0.7.0-3.20211109gitb79fd91]
    - Disable OpenSSL FIPS mode to avoid libtpms failures       Resolves: rhbz#2090219

    [0.7.0-2.20211109gitb79fd91]
    - Add fix for CVE-2022-23645.
      Resolves: rhbz#2056518

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8100 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8100 advisory.

    SWTPM is a TPM emulator built on libtpms providing TPM functionality for QEMU VMs.

    Security Fix(es):

    * swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7472 advisory.

    - Fix CVE-2022-2211 Denial of Service in --key parameter       resolves: rhbz#2101280
    - Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails       resolves: rhbz#2045718
    - nwfilter: fix crash when counting number of network filters (CVE-2022-0897, rhbz#2063902)
    - Fix CVE-2022-2211 Denial of Service in --key parameter       resolves: rhbz#2102720

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has swtpm packages installed that are affected by a vulnerability:

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7472 advisory.

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7472 advisory.

  - QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)

  - libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

  - libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)

  - swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7472 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0). (BZ#2066828)

    Security Fix(es):

    * QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)

    * libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

    * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)

    * swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1297-1 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9240 advisory.

    libtpms     [0.8.8-1.el7]
    - spec: Update spec file to version 0.8.8

    * Fri Sep 17 2021 Stefan Berger - 0.8.7-1
    - tpm2: Fixes for building and running with OpenSSL 3.0

    * Fri Sep 10 2021 Stefan Berger - 0.8.6-1
    - tpm2: Marshal event sequence objects' hash state

    * Wed Sep 01 2021 Stefan Berger - 0.8.5-1
    - tpm2: NVMarshal: Handle index orderly RAM without 0-sized terminating node
    - tpm2: Initialize a whole OBJECT before using it

    * Wed Jun 23 2021 Stefan Berger - 0.8.4-1
    - tpm2: Reset too large size indicators in TPM2B to avoid access beyond buffer

    * Tue Jun 01 2021 Stefan Berger - 0.8.3-1
    - tpm2: Work-around for Windows 2016 & 2019 bug related to ContextLoad

    swtpm     [0.3.4-5.el7]
    - swtpm: Check header size indicator against expected size (CID 375869) (Stefan       Berger)  [Orabug: 33876933]  {CVE-2022-23645}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	critical
206823	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.100173)	Nessus	Misc.	critical
198716	RHEL 8 : av_swtpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196021	RHEL 8 : swtpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191259	CentOS 9 : swtpm-0.8.0-1.el9 (deprecated)	Nessus	CentOS Local Security Checks	medium
191172	CentOS 9 : swtpm-0.7.0-2.20211109gitb79fd91.el9	Nessus	CentOS Local Security Checks	medium
184779	Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2022:7472)	Nessus	Rocky Linux Local Security Checks	medium
168120	Oracle Linux 9 : swtpm (ELSA-2022-8100)	Nessus	Oracle Linux Local Security Checks	medium
167955	AlmaLinux 9 : swtpm (ALSA-2022:8100)	Nessus	Alma Linux Local Security Checks	medium
167568	RHEL 9 : swtpm (RHSA-2022:8100)	Nessus	Red Hat Local Security Checks	medium
167524	Oracle Linux 8 : virt:ol / and / virt-devel:ol (ELSA-2022-7472)	Nessus	Oracle Linux Local Security Checks	medium
167468	NewStart CGSL MAIN 6.02 : swtpm Vulnerability (NS-SA-2022-0101)	Nessus	NewStart CGSL Local Security Checks	medium
167461	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2022:7472)	Nessus	Alma Linux Local Security Checks	medium
167183	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2022:7472)	Nessus	CentOS Local Security Checks	medium
167145	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2022:7472)	Nessus	Red Hat Local Security Checks	medium
160069	SUSE SLES15 Security Update : swtpm (SUSE-SU-2022:1297-1)	Nessus	SuSE Local Security Checks	medium
159123	Oracle Linux 7 : libtpms (ELSA-2022-9240)	Nessus	Oracle Linux Local Security Checks	medium

Detections

Analytics

CVE-2022-23645

medium

Tenable Plugins

critical

critical

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium