TPM2.0 vulnerable to out-of-bounds write

CVE-2023-1017

What is CVE-2023-1017?

An out-of-bounds write vulnerability in the TPM2.0 Module Library can be exploited due to improper handling of data in the CryptParameterDecryption routine. This flaw allows an attacker to write 2 bytes of data past the boundaries of the TPM2.0 command, potentially resulting in a denial of service. This can crash the TPM chip or process and may also enable arbitrary code execution within the TPM context, posing significant risks to systems relying on trusted computing features.

References