MGASA-2022-0112 - Updated swtpm packages fix security vulnerability Publication date: 23 Mar 2022 URL: https://advisories.mageia.org/MGASA-2022-0112.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-23645 swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645) References: - https://bugs.mageia.org/show_bug.cgi?id=30125 - https://lists.fedoraproject.org/archives/list/[email protected]/thread/WL735FW266GO4C2JX4CJBOIOB7R7AY5A/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23645 SRPMS: - 8/core/swtpm-0.7.1-1.mga8
Mageia 2022-0112: swtpm security update
swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface
Summary
swtpm is a libtpms-based TPM emulator with socket, character device, and
Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are
vulnerable to out-of-bounds read. A specially crafted header of swtpm's
state, where the blobheader's hdrsize indicator has an invalid value, may
cause an out-of-bounds access when the byte array representing the state
of the TPM is accessed. This will likely crash swtpm or prevent it from
starting since the state cannot be understood. Users should upgrade to
swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no
known workarounds. (CVE-2022-23645)
References
- https://bugs.mageia.org/show_bug.cgi?id=30125
- https://lists.fedoraproject.org/archives/list/[email protected]/thread/WL735FW266GO4C2JX4CJBOIOB7R7AY5A/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23645
Resolution
MGASA-2022-0112 - Updated swtpm packages fix security vulnerability
SRPMS
- 8/core/swtpm-0.7.1-1.mga8
Severity
Publication date: 23 Mar 2022
URL: https://advisories.mageia.org/MGASA-2022-0112.html
Type: security
CVE: CVE-2022-23645
News
HOWTOs
Features
Interview with Guardian Digital CEO Dave Wreski: Open Source Utilization in Email Security Solutions & More
Verifying Linux Server Security: What Every Admin Needs to Know
What Linux, Windows & Mac OS Users Need to Know About VPNs
Complete Guide to Vulnerability Basics
How To Get Live Updates on Critical Linux Security Advisories
About Us
Powered By
