[ASA-202107-9] libtpms: information disclosure

[Jonas Witschel]

Arch Linux Security Advisory ASA-202107-9
=========================================

Severity: Medium
Date    : 2021-07-01
CVE-ID  : CVE-2021-3623
Package : libtpms
Type    : information disclosure
Remote  : No
Link    : https://security.archlinux.org/AVG-2108

Summary
=======

The package libtpms before version 0.8.4-1 is vulnerable to information
disclosure.

Resolution
==========

Upgrade to 0.8.4-1.

# pacman -Syu "libtpms>=0.8.4-1"

The problem has been fixed upstream in version 0.8.4.

Workaround
==========

None.

Description
===========

A security issue was found in libtpms before version 0.8.4. The flaw
can be triggered by specially-crafted TPM 2 command packets containing
illegal values and may lead to an out-of-bounds access when the
volatile state of the TPM 2 is marshalled/written or unmarshalled/read.

Impact
======

An attacker could disclose sensitive information about the state of the
TPM through crafted command packets.

References
==========

https://bugzilla.redhat.com/show_bug.cgi?id=1976806
https://github.com/stefanberger/libtpms/pull/223
https://github.com/stefanberger/libtpms/pull/225
https://github.com/stefanberger/libtpms/commit/f16250b35aff6995e540143a9858c9cf0d1f9573
https://github.com/stefanberger/libtpms/commit/3ef9b26cb9f28bd64d738bff9505a20d4eb56acd
https://github.com/stefanberger/libtpms/commit/5cc98a62dc6f204dcf5b87c2ee83ac742a6a319b
https://security.archlinux.org/CVE-2021-3623
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210703/ad3fa267/attachment-0001.sig>