Search: CVE-2023-1018

An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.

Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in the Trusted Platform Module (TPM) 2.0 implementation on certain Google Compute Engine VMs. These vulnerabilities involve a 2-byte out-of-bounds read/write in the vTPM parameter decryption routine. CVE-2023-1017 could allow a local attacker to cause denial-of-service or possibly execute arbitrary code within the vTPM context. CVE-2023-1018 could allow a local attacker to leak limited data from the vTPM context. Google has automatically applied patches to all vulnerable VMs, and no customer action is required.