Vulnerability Description
A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libtpms Project | Libtpms | < 0.6.5 |
| Redhat | Enterprise Linux | 8.0 |
| Fedoraproject | Fedora | 34 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1976806Issue TrackingPatchThird Party Advisory
- https://github.com/stefanberger/libtpms/commit/2e6173cPatchThird Party Advisory
- https://github.com/stefanberger/libtpms/commit/2f30d62PatchThird Party Advisory
- https://github.com/stefanberger/libtpms/commit/7981d9aPatchThird Party Advisory
- https://github.com/stefanberger/libtpms/pull/223Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://bugzilla.redhat.com/show_bug.cgi?id=1976806Issue TrackingPatchThird Party Advisory
- https://github.com/stefanberger/libtpms/commit/2e6173cPatchThird Party Advisory
- https://github.com/stefanberger/libtpms/commit/2f30d62PatchThird Party Advisory
- https://github.com/stefanberger/libtpms/commit/7981d9aPatchThird Party Advisory
- https://github.com/stefanberger/libtpms/pull/223Issue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
FAQ
What is CVE-2021-3623?
CVE-2021-3623 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2...
How severe is CVE-2021-3623?
CVE-2021-3623 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3623?
Check the references section above for vendor advisories and patch information. Affected products include: Libtpms Project Libtpms, Redhat Enterprise Linux, Fedoraproject Fedora.