Out-Of-Bounds Write in TPM2 Reference Library on Google ChromeOS
CVE-2025-1122

6.7MEDIUM

Key Information:

Vendor
Google
Status
Chromeos
Vendor
CVE Published:
15 April 2025

Summary

A vulnerability exists in the TPM2 Reference Library within Google ChromeOS, specifically affecting version 122.0.6261.132 on Cr50 Boards. This flaw allows attackers with root access to manipulate the NV_Read functionality during the Challenge-Response process, potentially leading to persistence on the system and evasion of operating system verification mechanisms. This could enable unauthorized actions and threaten the integrity of the operating system.

Affected Version(s)

ChromeOS 122.0.6261.132

References

https://issuetracker.google.com/issues/324336238
https://issues.chromium.org/issues/b/324336238

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.