CVE-2025-49133 Libtpms contains a possible out-of-bound access and abort due to HMAC signing issue
A malicious user can trigger an out-of-bounds read in Libtpms, causing a virtual TPM to abort and resulting in denial of service for the virtual machine.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-49133?
CVE-2025-49133 is a medium-severity memory corruption vulnerability in stefanberger libtpms, published on 10 Jun 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the "Part 4: Supporting Routines – Code" document, section "7.151 - /tpm/src/crypt/CryptUtil.c ". This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.
Weakness: CWE-125
Which versions are affected by CVE-2025-49133?
It affects 1 product.
Linux distribution packages (40)
libtpms AlmaLinux:10 | All versions | 0.9.6-11.el10_0 |
SLOF AlmaLinux:8 | All versions | 20210217-2.module_el8.10.0+3768+dfd76e10 |
hivex AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+2880+7d9e3703 |
hivex AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+3161+a07c0ea5 |
hivex-devel AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+2880+7d9e3703 |
hivex-devel AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+3161+a07c0ea5 |
libguestfs AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-appliance AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-bash-completion AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-gfs2 AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-gobject AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-gobject-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-inspect-icons AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-java AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-java-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-javadoc AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-man-pages-ja AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-man-pages-uk AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-rescue AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-rsync AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-tools AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-tools-c AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libguestfs-winsupport AlmaLinux:8 | All versions | 8.10-1.module_el8.10.0+3768+dfd76e10 |
libguestfs-xfs AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3493+5ed0bd1c.alma |
libiscsi AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libiscsi-devel AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi-devel AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libiscsi-utils AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi-utils AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libnbd AlmaLinux:8 | All versions | 1.6.0-6.module_el8.10.0+3897+eb84924d |
libnbd-bash-completion AlmaLinux:8 | All versions | 1.6.0-6.module_el8.10.0+3897+eb84924d |
libnbd-devel AlmaLinux:8 | All versions | 1.6.0-6.module_el8.10.0+3897+eb84924d |
libtpms AlmaLinux:8 | All versions | 0.9.1-3.20211126git1ff6fe1f43.module_el8.10.0+4031+06966654 |
libtpms-devel AlmaLinux:8 | All versions | 0.9.1-3.20211126git1ff6fe1f43.module_el8.10.0+4031+06966654 |
libvirt AlmaLinux:8 | All versions | 8.0.0-23.4.module_el8.10.0+4031+06966654 |
libvirt-client AlmaLinux:8 | All versions | 8.0.0-23.4.module_el8.10.0+4031+06966654 |
libvirt-daemon AlmaLinux:8 | All versions | 8.0.0-23.4.module_el8.10.0+4031+06966654 |
libvirt-daemon-config-network AlmaLinux:8 | All versions | 8.0.0-23.4.module_el8.10.0+4031+06966654 |
Products include Libtpms Project Libtpms.
How do I fix CVE-2025-49133?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-49133 being exploited?
There is no known exploitation of CVE-2025-49133 in the wild and no public exploit code.
Other vulnerabilities in stefanberger libtpms
Sources
Also known as ALSA-2025:12100, ALSA-2025:12527, ALSA-2025:16428, AZL-63702, DEBIAN-CVE-2025-49133, GHSA-25w5-6fjj-hf8g and 23 more.