Description (CNA)
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Trusted Computing Group / TPM2.0 | affected 0 before 1.83 |
CWE
No CWE identifiers supplied.
References
- https://trustedcomputinggroup.org/about/security/
- https://trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spec-v1.83-Errata_v1_pub.pdf
- https://trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-FINAL.pdf
- https://github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1
- https://www.cve.org/CVERecord?id=CVE-2025-49133
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.
No English description supplied.