An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtpms: RSA keys weaker than expected (CVE-2021-3505)

  - tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtpms-0.9.1-3.20211126git1ff6fe1f43.el9 build changelog.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-2453 advisory.

    [0.9.1-3.20211126git1ff6fe1f43]
    - Backport 'tpm2: Check size of buffer before accessing it' (CVE-2023-1017 & CVE-2023-1018)       Resolves: rhbz#2173960       Resolves: rhbz#2173967

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:2453 advisory.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2453 advisory.

    The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

    Security Fix(es):

    * tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017)

    * tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2051-1 advisory.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1833 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * tpm: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1017)

    * tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Networking receive/transmit_bytes metrics values are swapped (BZ#2173977)

    * Logs are spammed with ' Domain id=7 is tainted: custom-ga-command' message (BZ#2180032)

    * [qemu] snapshot is failing with error libvirt.libvirtError: internal error: QEMU monitor reply exceeds     buffer size (10485760 bytes) (BZ#2181577)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4afddd37a9 advisory.

    Build of libtpms 0.9.6 with fixes for CVE-2023-1017 & CVE-2023-1018


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-64f2a84db1 advisory.

    Build of libtpms 0.9.6 with fixes for CVE-2023-1017 & CVE-2023-1018


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023702. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023697. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023706. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023713. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023696. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023698. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5023705. It is, therefore, affected by multiple vulnerabilities

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

  - Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2023-21708, CVE-2023-23405,     CVE-2023-24869, CVE-2023-24908)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5933-1 advisory.

    Francisco Falcon discovered that Libtpms did not properly manage memory when performing certain     cryptographic operations. An attacker could possibly use this issue to cause a denial of service, or     possibly execute arbitrary code. (CVE-2023-1017, CVE-2023-1018)

    It was discovered that Libtpms did not properly manage memory when handling certain commands. An attacker     could possibly use this issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c487bde4b4 advisory.

    Build of libtpms 0.9.6 with fixes for CVE-2023-1017 & CVE-2023-1018



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199893	RHEL 8 : av_libtpms (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196854	RHEL 8 : tpm (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191244	CentOS 9 : libtpms-0.9.1-3.20211126git1ff6fe1f43.el9	Nessus	CentOS Local Security Checks	high
175688	Oracle Linux 9 : libtpms (ELSA-2023-2453)	Nessus	Oracle Linux Local Security Checks	high
175648	AlmaLinux 9 : libtpms (ALSA-2023:2453)	Nessus	Alma Linux Local Security Checks	high
175400	RHEL 9 : libtpms (RHSA-2023:2453)	Nessus	Red Hat Local Security Checks	high
174926	SUSE SLES15 / openSUSE 15 Security Update : libtpms (SUSE-SU-2023:2051-1)	Nessus	SuSE Local Security Checks	high
174687	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:1833)	Nessus	Red Hat Local Security Checks	high
172628	Fedora 36 : libtpms (2023-4afddd37a9)	Nessus	Fedora Local Security Checks	high
172596	Fedora 38 : libtpms (2023-64f2a84db1)	Nessus	Fedora Local Security Checks	high
172533	KB5023702: Windows 10 version 1809 / Windows Server 2019 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172532	KB5023697: Windows 10 Version 1607 and Windows Server 2016 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172529	KB5023706: Windows 11 version 22H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172525	KB5023713: Windows 10 LTS 1507 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172521	KB5023696: Windows 10 Version 20H2 / Windows 10 Version 21H2 / Windows 10 Version 22H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172520	KB5023698: Windows 11 version 21H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172518	KB5023705: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (March 2023)	Nessus	Windows : Microsoft Bulletins	critical
172243	Ubuntu 22.04 LTS : Libtpms vulnerabilities (USN-5933-1)	Nessus	Ubuntu Local Security Checks	high
172114	Fedora 37 : libtpms (2023-c487bde4b4)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-1017

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

high

high