The vulnerability in swtpm's SWTPM_NVRAM_CheckHeader() function is due to an incorrect buffer length check using sizeof(bh) where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an attacker with local access to the control channel to send an 8-byte state blob that bypasses validation, causing a heap overread of 2 bytes on 64-bit systems (6 bytes on 32-bit) when reading the totlen field. The out-of-bounds read results in leaking adjacent heap data to the swtpm log and may cause daemon crashes on some platforms. This vulnerability is distinct from CVE-2022-23645, which addressed a different validation issue. Red Hat has assigned a CVSS v3.1 score of 6.1 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, and high availability impact. The issue is fixed in swtpm version 0.10.2. No other mitigations meet Red Hat's criteria for ease of use and deployment.

An attacker with local access to the swtpm control channel can cause a heap overread, leaking small amounts of adjacent heap memory to logs, potentially exposing sensitive information. The vulnerability can also cause the swtpm daemon to terminate unexpectedly, resulting in denial of service. The confidentiality impact is low, integrity impact is none, and availability impact is high. This may aid attackers in bypassing protection mechanisms by leaking memory addresses or other sensitive data.

Red Hat recommends upgrading to swtpm version 0.10.2, which contains the fix for this vulnerability. Currently, no other mitigations meet Red Hat's criteria for ease of use, applicability, or stability. Users should apply the official fix when available to prevent exploitation.