CVE-2017-16837 Code injection in n/a
Local attackers can execute arbitrary code and overwrite TPM PCRs by exploiting unvalidated function pointers in Trusted Boot.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16837?
CVE-2017-16837 is a high-severity code injection vulnerability in n/a, published on 16 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.
Weakness: CWE-20
Which versions are affected by CVE-2017-16837?
It affects 1 product.
Linux distribution packages (5)
tboot SUSE:Linux Enterprise Server 12 SP2 | All versions | 20160518_1.9.4-7.5.1 |
tboot SUSE:Linux Enterprise Server 12 SP3 | All versions | 20160518_1.9.4-7.5.1 |
tboot SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 20160518_1.9.4-7.5.1 |
tboot SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 20160518_1.9.4-7.5.1 |
tboot openSUSE:Tumbleweed | All versions | 20210614_1.10.2-2.2 |
Products include Trusted Boot Project Trusted Boot.
How do I fix CVE-2017-16837?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-16837 being exploited?
There is no known exploitation of CVE-2017-16837 in the wild and no public exploit code.
Sources
Also known as GHSA-86m6-cj8w-2c48, SUSE-SU-2017:3090-1, UBUNTU-CVE-2017-16837, openSUSE-SU-2024:11424-1.