The vulnerability in swtpm's SWTPM_NVRAM_CheckHeader() arises because the code checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This incorrect check allows an 8-byte buffer to pass validation when the expected struct size is 10 bytes, causing a heap overread of 2 bytes on 64-bit systems when accessing the totlen field. This out-of-bounds read can cause the swtpm daemon to terminate on some platforms and leak adjacent heap memory contents to the log. The issue is distinct from CVE-2022-23645, which addressed a related but different validation error. Red Hat has assigned a moderate severity rating and a CVSS 3.1 score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H). The vulnerability requires local access with low privileges and no user interaction. A fixed swtpm version 0.10.2 is available upstream, but Red Hat has not yet provided a direct fix for affected products. No effective mitigations meeting Red Hat's criteria are currently available.

An attacker with local access to the swtpm control channel can send a specially crafted 8-byte state blob that bypasses buffer length validation, causing a heap overread of 2 bytes on 64-bit systems. This can lead to daemon termination (denial of service) and leakage of adjacent heap memory data to logs, potentially exposing sensitive information. The confidentiality impact is low due to limited data leakage, integrity impact is none, and availability impact is high due to possible daemon crashes.

Red Hat currently states that no mitigation meeting their criteria for ease of use, deployment, applicability, or stability is available. The vulnerability is fixed in swtpm version 0.10.2. Users should upgrade to this fixed version when it becomes available in their distribution or apply vendor-provided patches once released. Until then, monitor Red Hat advisories for updates. No other mitigations are recommended by Red Hat at this time.