Vulnerability in Kernel: tpm: efi: Use local variable for calculating final log size
Summary
GSD-2021-1000143: tpm: efi: Use local variable for calculating final log size. Affects Kernel versions >= 166a2809d65b282272c474835ec22c882a39ca1b, < 60a01ecc9f68067e4314a0b55148e39e5d58a51b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and provides an interface for applications to interact with the hardware. It is responsible for tasks such as memory management, process scheduling, and device drivers. The vulnerability in question affects the TPM (Trusted Platform Module) subsystem in the Kernel. TPM is a hardware-based security feature that provides cryptographic functions and secure storage for sensitive data. The vulnerability specifically relates to the EFI (Extensible Firmware Interface) implementation in the TPM subsystem.
Vulnerability Detail
The vulnerability arises from a flaw in the calculation of the final log size in the TPM EFI implementation. By not using a local variable for this calculation, an attacker could potentially manipulate the log size and cause a buffer overflow or other memory corruption issues. The impact of this vulnerability could range from denial of service to arbitrary code execution, depending on the attacker's capabilities and the system's configuration. It is important to note that the actual impact and attack plausibility have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in the Kernel's TPM EFI implementation could potentially lead to memory corruption and other security issues. It is crucial to update the Linux Kernel to version v5.10.36 or a later version that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could range from denial of service to arbitrary code execution, depending on the attacker's capabilities and the system's configuration.
To fix this vulnerability, update the Linux Kernel to version v5.10.36 or any subsequent version that includes the fix.
No specific workaround has been mentioned for this vulnerability.
There is no information available regarding exploitation of this vulnerability in the wild.
For more details about this vulnerability, refer to the source link provided in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
