Lucene search

[email protected]CVE-2023-1018

HistoryFeb 28, 2023 - 6:15 p.m.

CVE-2023-1018

2023-02-2818:15:10

CWE-125

[email protected]

web.nvd.nist.gov

179

tpm2.0

module library

vulnerability

out-of-bounds read

nvd

cve-2023-1018

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.1%

JSON

An out-of-bounds read vulnerability exists in TPM2.0’s Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.

Affected configurations

NVD

Node

trustedcomputinggrouptrusted_platform_moduleMatch2.0revision_1.16

trustedcomputinggrouptrusted_platform_moduleMatch2.0revision_1.38

trustedcomputinggrouptrusted_platform_moduleMatch2.0revision_1.59

Node

microsoftwindows_10_1507Range<10.0.10240.19805x64

microsoftwindows_10_1607Range<10.0.14393.5786x64

microsoftwindows_10_1809Range<10.0.17763.4131x64

microsoftwindows_10_20h2Range<10.0.19042.2728x64

microsoftwindows_10_21h2Range<10.0.19044.2728x64

microsoftwindows_10_22h2Range<10.0.19045.2728x64

microsoftwindows_11_21h2Range<10.0.22000.1696x64

microsoftwindows_11_22h2Range<10.0.22621.1413x64

microsoftwindows_server_2016Range<10.0.14393.5786

microsoftwindows_server_2019Range<10.0.17763.4131

microsoftwindows_server_2022Range<10.0.20348.1607

CPENameOperatorVersion
trustedcomputinggroup:trusted_platform_moduletrustedcomputinggroup trusted platform moduleeq2.0

CPE	Name	Operator	Version
trustedcomputinggroup:trusted_platform_module	trustedcomputinggroup trusted platform module	eq	2.0

CNA Affected

[
  {
    "vendor": "Trusted Computing Group",
    "product": "TPM2.0",
    "versions": [
      {
        "status": "affected",
        "version": "1.59"
      }
    ]
  },
  {
    "vendor": "Trusted Computing Group",
    "product": "TPM2.0",
    "versions": [
      {
        "status": "affected",
        "version": "1.38"
      }
    ]
  },
  {
    "vendor": "Trusted Computing Group",
    "product": "TPM2.0",
    "versions": [
      {
        "status": "affected",
        "version": "1.16"
      }
    ]
  }
]