{"id":"CVE-2017-16837","aliases":["EUVD-2017-8011","GHSA-86m6-cj8w-2c48","SUSE-SU-2017:3090-1","UBUNTU-CVE-2017-16837","openSUSE-SU-2024:11424-1"],"status":"published","title":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause...","description":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00413,"percentile":0.35848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-11-16T02:00:00Z","modified":"2026-06-17T01:09:59Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"tboot","fixed_in":["20160518_1.9.4-7.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tboot","fixed_in":["20160518_1.9.4-7.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"tboot","fixed_in":["20160518_1.9.4-7.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tboot","fixed_in":["20160518_1.9.4-7.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tboot","fixed_in":["1.9.7-0ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tboot","fixed_in":["20210614_1.10.2-2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20160518_1.9.4-7.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20160518_1.9.4-7.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20160518_1.9.4-7.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20160518_1.9.4-7.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.6-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.7-0ubuntu1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210614_1.10.2-2.2"}]}]}],"products":[{"vendor":"trusted_boot_project","product":"trusted_boot"}],"references":[{"url":"https://sourceforge.net/p/tboot/code/ci/521c58e51eb5be105a29983742850e72c44ed80e/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://www.usenix.org/conference/usenixsecurity18/presentation/han","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16837"},{"url":"https://sourceforge.net/p/tboot/code/ci/521c58e51eb5be105a29983742850e72c44ed80e"},{"url":"https://github.com/advisories/GHSA-86m6-cj8w-2c48"},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173090-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1057555","tags":["report"]},{"url":"https://bugzilla.suse.com/1068390","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16837","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-16837","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16837","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-16837","description":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.","status":"published","published":"2017-11-16T02:00:00Z","modified":"2024-08-05T20:35:21.256Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-8011","description":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.","status":"published","published":"2017-11-16T02:00:00Z","modified":"2024-08-05T20:35:21Z","updated_at":"2026-11-03T02:23:11.533108Z"}],"ghsa":[{"id":"GHSA-86m6-cj8w-2c48","title":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause...","description":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.","status":"published","published":"2022-05-14T03:06:34Z","modified":"2025-04-20T03:49:31Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:56.152144Z"}],"nvd":[{"id":"CVE-2017-16837","description":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.","status":"published","published":"2017-11-16T02:29:05.49Z","modified":"2026-06-17T01:09:59.963Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:08.635428Z"}],"osv":[{"id":"UBUNTU-CVE-2017-16837","description":"Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.","status":"published","published":"2017-11-16T02:29:00Z","modified":"2025-10-24T04:46:36Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"openSUSE-SU-2024:11424-1","title":"tboot-20210614_1.10.2-2.2 on GA media","description":"These are all security issues fixed in the tboot-20210614_1.10.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:24:27.333537Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:3090-1","title":"Recommended update for tboot","description":"This update for tboot fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-16837: Certain function pointers in Trusted Boot (tboot) through 1.9.6 are\n  notvalidated and can cause arbitrary code execution, which allows local users\n  tooverwrite dynamic PCRs of Trusted Platform Module (TPM) by h (bsc#1068390)\n\nBug fixes:\n\n- Fixed failed trusted boot on some systems like Intel Xeon 'Purley 8s' processors. The\n  following error message showed: 'TBOOT: wait-for-sipi loop timed-out'. Booting continued\n  but 'TXT measured launch' was wrongly reported as FALSE. (bsc#1057555)\n","status":"published","published":"2017-11-24T15:17:52Z","modified":"2026-02-04T02:22:40.973276Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}