Out-of-Bounds Read Vulnerability in TCG TPM2.0 Implementation

CVE-2025-2884

What is CVE-2025-2884?

The TCG TPM2.0 Reference Implementation contains a vulnerability in the CryptHmacSign helper function. This flaw arises from insufficient validation of the signature scheme that corresponds to the signature key's algorithm, potentially allowing unauthorized access to sensitive data through an Out-of-Bounds read. For details, refer to Errata 1.83 of TCG's TPM2.0 standard.

References