Responder can Invoke Undefined Behavior in libspdm Requester

CVE-2023-32690

What is CVE-2023-32690?

The libspdm implementation, prior to versions 2.3.3 and 3.0, is affected by a vulnerability where the Requester does not validate the Responder's CTExponent after receiving a CAPABILITIES response. This oversight permits the use of an unvalidated value during cryptographic operations, exposing the system to timing attacks. It is critical for users of libspdm to apply the patch available in version 2.3.3 or implement the recommended workaround, which entails checking the Responder's CTExponent after the VCA to prevent potential exploitation.

References