{"id":"CVE-2021-3746","aliases":["DEBIAN-CVE-2021-3746","EUVD-2021-27022","GHSA-9ffq-6fp7-34mv","MGASA-2021-0590","OESA-2022-1695","SUSE-SU-2021:3004-1","SUSE-SU-2021:3004-2","UBUNTU-CVE-2021-3746","openSUSE-SU-2021:3004-1","openSUSE-SU-2024:11004-1"],"status":"published","title":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal...","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00966,"percentile":0.6215,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2021-09-09T13:20:48Z","modified":"2026-10-24T10:30:20Z","fixes":[{"ecosystem":"Debian:12","package":"libtpms","fixed_in":["0.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libtpms","fixed_in":["0.9.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libtpms","fixed_in":["0.9.1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"libtpms","fixed_in":["0.8.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libtpms","fixed_in":["0.8.2-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libtpms","fixed_in":["0.8.2-3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.1-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:8","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-5.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3-7.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3-7.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libtpms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2-3.3.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libtpms_project","product":"libtpms"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"stefanberger","product":"libtpms"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998588","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3746","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9ffq-6fp7-34mv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3746","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0590.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28882","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/46YMIRHQHNKPCVNRVW4W27MFQQU7ZHHV/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Z7KZSYMTE7Z4BBEZUWO2DIMQDWMGEP46/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DZI42OR3JUEGWRKEVCOHL2FPTJVYCYBT/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7UCZ7AV2UKWYYCNZ2NLLXW7QYCX7K337/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/75RD2O2OFCMWPCMY5QMSZRNV5PG5BTS6/","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YVJSXDXD44WDR4VA2XL33IZDJTBGRXP7/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7E3B6T5RBDKAWETDTW3WPORY3NK5IR46/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1695","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3623","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213004-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189935","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3746","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213004-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3746","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3505","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3746","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","status":"published","published":"2021-10-19T14:07:43Z","modified":"2024-08-03T17:01:07.979Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-27022","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","status":"published","published":"2021-10-19T14:07:43Z","modified":"2024-08-03T17:01:07Z","updated_at":"2026-11-03T03:25:12.535968Z"}],"ghsa":[{"id":"GHSA-9ffq-6fp7-34mv","title":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal...","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","status":"published","published":"2022-05-24T19:17:56Z","modified":"2023-01-30T05:02:51Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:46:43.616467Z"}],"nvd":[{"id":"CVE-2021-3746","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","status":"published","published":"2021-10-19T15:15:08.003Z","modified":"2026-06-17T04:05:41.203Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":7.1,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:07:00.137719Z"}],"osv":[{"id":"CVE-2021-3746","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","status":"published","published":"2021-10-19T15:15:08.003Z","modified":"2026-10-24T10:30:20.097167229Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-3746","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","status":"published","published":"2021-10-19T15:15:08.003Z","modified":"2026-10-23T18:03:30.099081995Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"OESA-2022-1695","title":"libtpms security update","description":"A library providing TPM functionality for VMs. Targeted for integration into Qemu.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2\u0026apos;s volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.(CVE-2021-3746)\r\n\r\nA flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.(CVE-2021-3623)","status":"published","published":"2022-06-02T11:04:58Z","modified":"2026-08-18T01:16:41.265873789Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-3746","description":"A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.","status":"withdrawn","published":"2021-10-19T15:15:00Z","modified":"2025-07-16T08:15:47.536759Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"MGASA-2021-0590","title":"Updated libtpms/swtpm packages fix security vulnerability","description":"CryptSym: fix AES output IV (CVE-2021-3505).\nFixed a context save and suspend/resume problem when public keys are\nloaded.\nReset too large size indicators in TPM2B to avoid access beyond buffer\n(CVE-2021-3623)\nRestore original value in buffer if unmarshalled one was illegal\nFixed out-of-bounds access via specially crafted TPM 2 command packets\n(CVE-2021-3746)\nMarshal event sequence objects' hash state\n","status":"published","published":"2021-12-30T16:41:51Z","modified":"2026-04-16T04:42:15.129626592Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:3004-1","title":"Security update for libtpms","description":"This update for libtpms fixes the following issues:\n\n- CVE-2021-3746: Fixed out-of-bounds access via specially crafted TPM 2 command packets (bsc#1189935).\n","status":"published","published":"2021-09-09T13:20:49Z","modified":"2026-02-04T03:51:05.058168Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11004-1","title":"libtpms-devel-0.8.4-2.2 on GA media","description":"These are all security issues fixed in the libtpms-devel-0.8.4-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:12:56.602838Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:3004-1","title":"Security update for libtpms","description":"This update for libtpms fixes the following issues:\n\n- CVE-2021-3746: Fixed out-of-bounds access via specially crafted TPM 2 command packets (bsc#1189935).\n","status":"published","published":"2021-09-09T13:20:48Z","modified":"2026-02-04T02:56:58.014661Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3004-2","title":"Security update for libtpms","description":"This update for libtpms fixes the following issues:\n\n- CVE-2021-3746: Fixed out-of-bounds access via specially crafted TPM 2 command packets (bsc#1189935).\n","status":"published","published":"2021-09-21T14:39:00Z","modified":"2026-02-04T04:02:33.7685Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}