Security Defects in TPM 2.0 Reference Library Expose Devices to Code Execution Attacks
February 28, 2023
Security researchers at Quarkslab have identified two serious security defects in the Trusted Platform Module (TPM) 2.0 reference library specification, tracked as CVE-2023-1017 and CVE-2023-1018, which provide pathways for an authenticated, local attacker to overwrite protected data in the TPM firmware and launch code execution attacks. According to Carnegie Mellon’s CERT coordination center, “An authenticated, local attacker could send maliciously crafted commands to a vulnerable TPM allowing access to sensitive data. In some cases, the attacker can also overwrite protected data in the TPM firmware. This may lead to a crash or arbitrary code execution within the TPM. Because the attacker’s payload runs within the TPM, it may be undetectable by other components of the target device.”
The Trusted Computing Group (TCG) has issued an Errata documenting the two memory corruption issues and providing mitigation guidance. The two vulnerabilities exist in the way the TPM reference spec processes parameters that are part of TPM commands. As the CERT coordination center warned, “An attacker with access to a device built with a vulnerable version of the TPM can trigger this bug by sending crafted commands to the TPM. The vulnerable TPM can thus be tricked to access data that is not part of the intended operation. As the OS relies on the TPM firmware for these functions, it may be difficult to detect or prevent such access using traditional host-based security capabilities.” Quoting the advisory, “As these attacks involve TPM-based software, mechanisms such as user-password or PIN protection and tpm-totp do not protect against attacks leveraging the [memory corruption] vulnerabilities.”
The CERT coordination center is urging users to apply any updates provided by hardware and software manufacturers through their supply chain as soon as possible. In high-assurance computing environments, users should consider using TPM Remote Attestation to detect any changes to devices and ensure their TPM is tamper-proof.
Latest News
- CISA Adds CVE-2022-36537 to Known Exploited Vulnerabilities Catalog
- Hackers Exploit Critical Vulnerabilities in Houzez Theme and Plugin
- RIG Exploit Kit Reaches All-Time High Success Rate
- Fortinet Clarifies Reports of CVE-2022-39952 Exploitation
- Hundreds of Popular Container Images Contain Hidden Vulnerabilities
Like what you see?
Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.
