NVD Vulnerability Detail

CVE-2021-3623

Summary	A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.
Publication Date	March 3, 2022, 8:15 a.m.
Registration Date	March 3, 2022, noon
Last Update	Nov. 21, 2024, 3:22 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:libtpms_project:libtpms::::::::	0.8.0			0.8.4
cpe:2.3:a:libtpms_project:libtpms::::::::	0.7.0			0.7.8
cpe:2.3:a:libtpms_project:libtpms::::::::				0.6.5

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:8.0::::advanced_virtualization:::

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:fedoraproject:fedora:34:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=1976806	Issue Tracking Patch Third Party Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=1976806	Issue Tracking Patch Third Party Advisory
3	https://github.com/stefanberger/libtpms/commit/2e6173c	Patch Third Party Advisory
4	https://github.com/stefanberger/libtpms/commit/2e6173c	Patch Third Party Advisory
5	https://github.com/stefanberger/libtpms/commit/2f30d62	Patch Third Party Advisory
6	https://github.com/stefanberger/libtpms/commit/2f30d62	Patch Third Party Advisory
7	https://github.com/stefanberger/libtpms/commit/7981d9a	Patch Third Party Advisory
8	https://github.com/stefanberger/libtpms/commit/7981d9a	Patch Third Party Advisory
9	https://github.com/stefanberger/libtpms/pull/223	Issue Tracking Third Party Advisory
10	https://github.com/stefanberger/libtpms/pull/223	Issue Tracking Third Party Advisory
11	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7KZSYMTE7Z4BBEZUWO2DIMQDWMGEP46/
12	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7KZSYMTE7Z4BBEZUWO2DIMQDWMGEP46/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

Stefan Berger の libtpms 他複数ベンダの製品における境界外書き込みに関する脆弱性

Title	Stefan Berger の libtpms 他複数ベンダの製品における境界外書き込みに関する脆弱性
Summary	Stefan Berger の libtpms 他複数ベンダの製品には、境界外書き込みに関する脆弱性が存在します。
Possible impacts	情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	参考情報を参照して適切な対策を実施してください。
Publication Date	June 28, 2021, midnight
Registration Date	July 4, 2023, 5:36 p.m.
Last Update	July 4, 2023, 5:36 p.m.

Affected System

Stefan Berger

libtpms 0.6.5 未満

libtpms 0.7.0 以上 0.7.8 未満

libtpms 0.8.0 以上 0.8.4 未満

レッドハット

Red Hat Enterprise Linux 8.0

Fedora Project

Fedora 34

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-3623	https://www.cve.org/CVERecord?id=CVE-2021-3623
National Vulnerability Database (NVD)
2	CVE-2021-3623	https://nvd.nist.gov/vuln/detail/CVE-2021-3623

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

その他

No	Name	URL
関連文書
1	bugzilla.redhat.com (1976806)	https://bugzilla.redhat.com/show_bug.cgi?id=1976806
2	github.com (2e6173c)	https://github.com/stefanberger/libtpms/commit/2e6173c
3	github.com (2f30d62)	https://github.com/stefanberger/libtpms/commit/2f30d62
4	github.com (7981d9a)	https://github.com/stefanberger/libtpms/commit/7981d9a
5	github.com (pull/223)	https://github.com/stefanberger/libtpms/pull/223
6	lists.fedoraproject.org (Z7KZSYMTE7Z4BBEZUWO2DIMQDWMGEP46)	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7KZSYMTE7Z4BBEZUWO2DIMQDWMGEP46/

Change Log

No	Changed Details	Date of change
1	[2023年07月04日] 掲載	July 4, 2023, 5:36 p.m.