CVE-2021-3746

EUVD-2021-27022
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Affected Products (NVD)
VendorProductVersion
libtpms_projectlibtpms
0.6.0 ≤
𝑥
< 0.6.6
libtpms_projectlibtpms
0.7.0 ≤
𝑥
< 0.7.9
libtpms_projectlibtpms
0.8.0 ≤
𝑥
< 0.8.5
redhatenterprise_linux
8.0
redhatenterprise_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libtpms
bookworm
0.9.2-3.1
fixed
bookworm (security)
0.9.2-3.1~deb12u1
fixed
sid
0.9.2-3.1
fixed
trixie
0.9.2-3.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libtpms
hirsute
ignored
impish
ignored
jammy
not-affected
trusty
ignored
xenial
ignored
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1998588
https://bugzilla.redhat.com/show_bug.cgi?id=1998588