CVE-2021-3623 Memory corruption in libtpms

Medium 6.1 Published 2 Mar 2022 Updated 3 Aug 2024

A flaw in libtpms allows out-of-bounds access via crafted TPM 2 packets, leading to system availability loss.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-3623?

CVE-2021-3623 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 2 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability.

Weakness: CWE-787

Which versions are affected by CVE-2021-3623?

It affects 3 products.

Linux distribution packages (9)

`libtpms` SUSE:Linux Enterprise Micro 5.1	All versions	`0.8.2-150300.3.6.1`
`libtpms` SUSE:Linux Enterprise Micro 5.2	All versions	`0.8.2-150300.3.6.1`
`libtpms` SUSE:Linux Enterprise Micro 5.3	All versions	`0.8.2-150300.3.6.1`
`libtpms` SUSE:Linux Enterprise Module for Server Applications 15 SP3	All versions	`0.8.2-150300.3.6.1`
`libtpms` SUSE:Linux Enterprise Module for Server Applications 15 SP4	All versions	`0.8.2-150300.3.6.1`
`libtpms` openSUSE:Leap 15.3	All versions	`0.8.2-150300.3.6.1`
`libtpms` openSUSE:Leap 15.4	All versions	`0.8.2-150300.3.6.1`
`libtpms` openSUSE:Leap Micro 5.2	All versions	`0.8.2-150300.3.6.1`
`libtpms` openSUSE:Leap Micro 5.3	All versions	`0.8.2-150300.3.6.1`

Products include Fedoraproject Fedora, Libtpms Project Libtpms, Redhat Enterprise Linux.

How do I fix CVE-2021-3623?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-3623 being exploited?

There is no known exploitation of CVE-2021-3623 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-3623, GHSA-6527-9qhc-39j4, SUSE-SU-2022:4457-1, openSUSE-SU-2024:12445-1.