{"id":"CVE-2023-22745","aliases":["ALSA-2023:6685","ALSA-2023:7166","AZL-13055","AZL-69129","BELL-CVE-2023-22745","CLSA-2025-1760021057","DEBIAN-CVE-2023-22745","EUVD-2023-26863","GHSA-4j3v-fh23-vx67","MGASA-2023-0050","OESA-2023-1079","RHSA-2023:6685","RHSA-2023:7166","RHSA-2024:4408","RHSA-2024:4739","SUSE-SU-2023:0526-1","SUSE-SU-2023:0613-1","UBUNTU-CVE-2023-22745","USN-6796-1","openSUSE-SU-2024:12629-1"],"status":"published","title":"Buffer Overlow in TSS2_RC_Decode in tpm2-tss","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00537,"percentile":0.45591,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2023-01-19T22:12:40Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"tpm2-tss","fixed_in":["3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tpm2-tss-devel","fixed_in":["3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tpm2-tss","fixed_in":["2.3.2-5.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tpm2-tss-devel","fixed_in":["2.3.2-5.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"tpm2-tss","fixed_in":["2.4.6-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"tpm2-tss","fixed_in":["4.0.1-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"tpm2-tss","fixed_in":["3.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"tpm2-tss","fixed_in":["4.0.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tpm2-tss","fixed_in":["3.0.3-8.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tpm2-tss-devel","fixed_in":["3.0.3-8.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tpm2-tss","fixed_in":["3.2.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tpm2-tss","fixed_in":["3.2.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tpm2-tss","fixed_in":["3.2.1-3"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"tpm2-tss","fixed_in":["3.2.2-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"tpm2-tss","fixed_in":["3.0.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"tpm2-tss","fixed_in":["3.0.3-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"tpm2-tss","fixed_in":["3.1.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"tpm2-tss","fixed_in":["3.1.0-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tss","fixed_in":["0:3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tss-debuginfo","fixed_in":["0:3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tss-debugsource","fixed_in":["0:3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"tpm2-tss-debuginfo","fixed_in":["0:3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"tpm2-tss-debugsource","fixed_in":["0:3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"tpm2-tss-devel","fixed_in":["0:3.2.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss","fixed_in":["0:2.3.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss-debuginfo","fixed_in":["0:2.3.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss-debugsource","fixed_in":["0:2.3.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss-devel","fixed_in":["0:2.3.2-5.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss-debuginfo","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss-debugsource","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss-devel","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss-debuginfo","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss-debugsource","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss-devel","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss-debuginfo","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss-debugsource","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss-devel","fixed_in":["0:2.3.2-5.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss","fixed_in":["0:2.3.2-5.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss-debuginfo","fixed_in":["0:2.3.2-5.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss-debugsource","fixed_in":["0:2.3.2-5.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss-devel","fixed_in":["0:2.3.2-5.el8_8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.3.1","2.4.5-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"tpm2-0-tss","fixed_in":["2.4.5-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tpm2-tss","fixed_in":["2.3.2-1ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tpm2-tss","fixed_in":["3.2.0-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-5.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-5.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-r0"},{"fixed":"3.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-r0"},{"fixed":"4.0.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-8.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-8.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"tpm2-tss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"tpm2-tss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"tpm2-tss-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.2-5.el8_8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1ubuntu0.20.04.2"}]}],"versions":["2.1.0-4","2.3.1-3","2.3.2-1","2.3.2-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1ubuntu1.1"}]}],"versions":["3.0.3-2ubuntu1","3.0.3-2ubuntu2","3.1.0-3ubuntu1","3.2.0-0ubuntu2","3.2.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1ubuntu0.20.04.2"}]}],"versions":["2.1.0-4","2.3.1-3","2.3.2-1","2.3.2-1ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1ubuntu1.1"}]}],"versions":["3.0.3-2ubuntu1","3.0.3-2ubuntu2","3.1.0-3ubuntu1","3.2.0-0ubuntu2","3.2.0-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-7.1ubuntu5.1"}]}],"versions":["4.0.1-3ubuntu1","4.0.1-6ubuntu1","4.0.1-7ubuntu1","4.0.1-7.1ubuntu4","4.0.1-7.1ubuntu5"],"bundled":2}],"products":[{"vendor":"tpm2-software","product":"tpm2-tss"},{"vendor":"tpm2_software_stack_project","product":"tpm2_software_stack"}],"references":[{"url":"https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf","tags":["x_refsource_MISC","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6685","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22745","tags":["report"]},{"url":"https://bugzilla.redhat.com/2162610","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6685.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7166","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7166.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22745","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-22745","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1760021057.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22745.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22745","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0050.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31532","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GDNOV2RNQ7XMOQZ3PV7PHYP2FMJHV2AB/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1079","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162610","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6685.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22745","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7166.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4408","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4408.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4739","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4739.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230526-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207325","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22745","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230613-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-22745","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6796-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-29040","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-22745","title":"Buffer Overlow in TSS2_RC_Decode in tpm2-tss","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T22:12:40.208Z","modified":"2025-11-21T19:10:18.693Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-26863","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T22:12:40Z","modified":"2025-11-21T19:10:18Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:13.665045Z"}],"nvd":[{"id":"CVE-2023-22745","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T23:15:26.907Z","modified":"2026-06-17T05:36:05.093Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:07:45.305824Z"}],"osv":[{"id":"AZL-13055","title":"CVE-2023-22745 affecting package tpm2-tss for versions less than 2.4.6-2","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T23:15:26Z","modified":"2026-04-21T04:22:36.190795Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"AZL-69129","title":"CVE-2023-22745 affecting package tpm2-tss for versions less than 4.0.1-1","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T23:15:26Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:23.994498Z"},{"id":"BELL-CVE-2023-22745","status":"published","published":"2023-10-18T13:44:37.106035Z","modified":"2026-01-26T09:33:10.784739Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-22745","title":"Buffer Overlow in TSS2_RC_Decode in tpm2-tss","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T22:12:40.208Z","modified":"2026-10-28T10:31:51.218503792Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-22745","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T23:15:26.907Z","modified":"2026-10-26T18:01:36.527816651Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"OESA-2023-1079","title":"tpm2-tss security update","description":"tpm2-tss is a software stack supporting Trusted Platform Module(TPM) 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers.\r\n\r\nSecurity Fix(es):\r\n\r\ntpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege.(CVE-2023-22745)","status":"published","published":"2023-02-10T11:05:33Z","modified":"2026-08-18T01:17:31.467509362Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:6685","title":"Red Hat Security Advisory: tpm2-tss security and enhancement update","status":"published","published":"2024-09-16T12:35:12Z","modified":"2026-07-03T10:03:56Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:7166","title":"Red Hat Security Advisory: tpm2-tss security and enhancement update","status":"published","published":"2024-09-16T12:35:21Z","modified":"2026-07-03T10:04:06Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:4408","title":"Red Hat Security Advisory: tpm2-tss security update","status":"published","published":"2024-09-16T12:35:30Z","modified":"2026-07-03T10:05:43Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4739","title":"Red Hat Security Advisory: tpm2-tss security update","status":"published","published":"2024-09-16T12:35:39Z","modified":"2026-07-03T10:05:49Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2023-22745","description":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","status":"published","published":"2023-01-19T23:15:00Z","modified":"2026-04-22T14:02:48.764203Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:6685","title":"Low: tpm2-tss security and enhancement update","description":"The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API library. This library enables programs to interact with TPM 2.0 devices\n\nSecurity Fix(es):\n\n* tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:35.398218743Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:7166","title":"Low: tpm2-tss security and enhancement update","description":"The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API library. This library enables programs to interact with TPM 2.0 devices\n\nSecurity Fix(es):\n\n* tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.191540289Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2025-1760021057","title":"tpm2-tss: Fix of CVE-2023-22745","description":"- CVE-2023-22745: fix out-of-bounds access in tss2_rc layer handler","status":"published","published":"2025-10-09T14:44:25Z","modified":"2026-06-01T00:31:18.241119152Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"MGASA-2023-0050","title":"Updated tpm2-tss packages fix security vulnerability","description":"Tss2_RC_SetHandler and Tss2_RC_Decode both index into layer_handler with\nan 8 bit layer number, but the array only has\nTPM2_ERROR_TSS2_RC_LAYER_COUNT entries, so trying to add a handler for\nhigher-numbered layers or decode a response code with such a layer number\nreads/writes past the end of the buffer. (CVE-2023-22745)\n","status":"published","published":"2023-02-14T22:43:23Z","modified":"2026-04-16T04:41:42.206464785Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12629-1","title":"libtss2-esys0-3.2.0-3.1 on GA media","description":"These are all security issues fixed in the libtss2-esys0-3.2.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:14:41.475843Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0526-1","title":"Security update for tpm2-0-tss","description":"This update for tpm2-0-tss fixes the following issues:\n\n- CVE-2023-22745: Fixed a memory safety issue that could be exploited\n  by local attackers with TPM access (bsc#1207325).\n","status":"published","published":"2023-02-27T12:52:46Z","modified":"2026-02-04T04:39:02.084415Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0613-1","title":"Security update for tpm2-0-tss","description":"This update for tpm2-0-tss fixes the following issues:\n\n- CVE-2023-22745: Fixed a memory safety issue that could be exploited\n  by local attackers with TPM access (bsc#1207325).\n","status":"published","published":"2023-03-03T11:07:53Z","modified":"2026-02-04T02:39:55.385261Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"USN-6796-1","title":"tpm2-tss vulnerabilities","description":"Fergus Dall discovered that TPM2 Software Stack did not properly handle\nlayer arrays. An attacker could possibly use this issue to cause \nTPM2 Software Stack to crash, resulting in a denial of service, or \npossibly execute arbitrary code.\n(CVE-2023-22745)\n\nJurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not \nvalidate the quote data after deserialization. An attacker could generate\nan arbitrary quote and cause TPM2 Software Stack to have unknown behavior. \n(CVE-2024-29040)\n","status":"published","published":"2024-05-29T13:21:53Z","modified":"2026-04-27T17:15:01.818342Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}