CVE-2017-16837

Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
VendorProductVersion
trusted_boot_projecttrusted_boot
1.9.6
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tboot
bullseye
1.9.12+hg20200718-1
fixed
sid
1.10.5-4
fixed
bookworm
1.10.5-4
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tboot
noble
Fixed 1.9.7-0ubuntu1
released
mantic
Fixed 1.9.7-0ubuntu1
released
lunar
Fixed 1.9.7-0ubuntu1
released
kinetic
Fixed 1.9.7-0ubuntu1
released
jammy
Fixed 1.9.7-0ubuntu1
released
impish
Fixed 1.9.7-0ubuntu1
released
hirsute
Fixed 1.9.7-0ubuntu1
released
groovy
Fixed 1.9.7-0ubuntu1
released
focal
Fixed 1.9.7-0ubuntu1
released
eoan
Fixed 1.9.7-0ubuntu1
released
disco
Fixed 1.9.7-0ubuntu1
released
cosmic
Fixed 1.9.7-0ubuntu1
released
bionic
needed
artful
ignored
zesty
ignored
xenial
needed
trusty
dne