Search: CVE-2023-1017

CVE-2023-1017 is an out-of-bounds write vulnerability in the Trusted Computing Group's TPM2.0 Module Library. It allows writing 2 bytes beyond the intended buffer in the CryptParameterDecryption routine. Successful exploitation can cause denial of service by crashing the TPM or making it unusable, and may also enable arbitrary code execution within the TPM context. The vulnerability affects TPM2.0 version 1.59. No public exploit or patch information is currently available.

Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in the Trusted Platform Module (TPM) 2.0 implementation on certain Google Compute Engine VMs. These vulnerabilities involve a 2-byte out-of-bounds read/write in the vTPM parameter decryption routine. CVE-2023-1017 could allow a local attacker to cause denial-of-service or possibly execute arbitrary code within the vTPM context. CVE-2023-1018 could allow a local attacker to leak limited data from the vTPM context. Google has automatically applied patches to all vulnerable VMs, and no customer action is required.