GCP-2023-004
Source GCP Compute Engine Security
Mentioned vulnerabilities
Rated Medium by Threat Radar's AI analysis
Data as of 26 Oct 2026, 22:15 UTC
What to do
AI-suggested
Google has automatically applied patches to all vulnerable Compute Engine VMs to mitigate these vulnerabilities. No customer action is required.
Description
Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in the Trusted Platform Module (TPM) 2.0 implementation on certain Google Compute Engine VMs. These vulnerabilities involve a 2-byte out-of-bounds read/write in the vTPM parameter decryption routine. CVE-2023-1017 could allow a local attacker to cause denial-of-service or possibly execute arbitrary code within the vTPM context. CVE-2023-1018 could allow a local attacker to leak limited data from the vTPM context. Google has automatically applied patches to all vulnerable VMs, and no customer action is required.